NEAS[.]6eb92a7697bd8abf6092341812b4e8f0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.6eb92a7697bd8abf6092341812b4e8f0.exe
Size

474KB
MD5

6eb92a7697bd8abf6092341812b4e8f0
SHA1

c57193a876162587129f3ad5dbaaa9dc8b55b12b
SHA256

58d144e317cf64508724ea301cb71c6dc9e0cae644a9c400db50fc244ac2c5c3
SHA512

e9d9256d884c0d21bf640efc0f9c2f2db362cb3e7690c70f5a178991b854756793063992ae7ecf78e462278d24e5f3c9bcad757d0c82cf7a943de0a6faf74fa4
SSDEEP

12288:I3ZBRrxcCGpiPxtHkaKxwIl9bFJMorA0YWLhJgnL3bqM/45L+6xPcpB5i:GWisbFJMowEM/41+6Gpvi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.6eb92a7697bd8abf6092341812b4e8f0.exe

Files

NEAS.6eb92a7697bd8abf6092341812b4e8f0.exe
.exe windows:5 windows x86

a719d02c9000d3975d21f932afa8fc8a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
CreateMutexA
GetVersionExW
ReleaseMutex
WriteProcessMemory
SetLastError
lstrlenW
TerminateProcess
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
VirtualAllocEx
CreateProcessW
GetLongPathNameW
ExpandEnvironmentStringsW
IsValidCodePage
MultiByteToWideChar
GetUserDefaultLCID
IsValidLocale
WideCharToMultiByte
FileTimeToSystemTime
FileTimeToLocalFileTime
CreateEventW
DeviceIoControl
VirtualProtectEx
SetThreadContext
ResumeThread
GetThreadContext
VirtualQueryEx
CreateThread
GetExitCodeThread
CreateNamedPipeW
ConnectNamedPipe
PeekNamedPipe
HeapSize
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
FlushFileBuffers
GetProcessHeap
GetFileSize
SetFilePointerEx
HeapAlloc
GetFileAttributesW
LocalAlloc
SetEndOfFile
VirtualAlloc
GetDiskFreeSpaceW
VirtualFree
HeapFree
CreateDirectoryW
WaitForSingleObject
GetTickCount
GetSystemWindowsDirectoryW
GetModuleHandleW
ReadProcessMemory
ReadFile
LocalFree
Sleep
GetSystemDirectoryW
GetLocaleInfoW
GetTempPathW
GetCurrentProcess
FreeLibrary
GetProcAddress
LoadLibraryW
GetDriveTypeW
FindClose
FindNextFileW
FindFirstFileW
GetLogicalDrives
GetCurrentProcessId
GetOEMCP
FindFirstFileExW
HeapReAlloc
GetTimeZoneInformation
GetConsoleCP
ReadConsoleW
GetConsoleMode
UnmapViewOfFile
GetCurrentThreadId
GetModuleFileNameW
GetCommandLineW
GetLastError
WriteFile
EnumSystemLocalesW
GetFileType
GetACP
GetStdHandle
GetModuleHandleExW
ExitProcess
LoadLibraryExW
RaiseException
RtlUnwind
OutputDebugStringA
SetPriorityClass
WritePrivateProfileStringW
GetPrivateProfileStringW
GetVolumeInformationW
InitializeSListHead
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
CloseHandle
CreateFileW
DisconnectNamedPipe
LCMapStringW
CompareStringW
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
InitializeCriticalSectionAndSpinCount
GetStringTypeW

user32

wsprintfW

advapi32

GetUserNameW
AddAccessAllowedAce
GetLengthSid
InitializeAcl
InitializeSecurityDescriptor
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
ConvertStringSidToSidW
IsValidSid
SetSecurityDescriptorDacl

shell32

SHGetSpecialFolderPathW

shlwapi

PathFileExistsW

rpcrt4

UuidCreate
UuidToStringA
RpcStringFreeA

ws2_32

gethostname
freeaddrinfo
ntohl
recv
send
inet_ntoa
inet_addr
WSAStartup
getaddrinfo
WSACleanup
closesocket
htons
socket
setsockopt
connect

iphlpapi

GetAdaptersInfo

winhttp

WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpCloseHandle
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpCrackUrl

Sections

.text
Size: 369KB - Virtual size: 368KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a719d02c9000d3975d21f932afa8fc8a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

shlwapi

rpcrt4

ws2_32

iphlpapi

winhttp

Sections

.text Size: 369KB - Virtual size: 368KB

.rdata Size: 81KB - Virtual size: 80KB

.data Size: 5KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 18KB - Virtual size: 17KB

.text
Size: 369KB - Virtual size: 368KB

.rdata
Size: 81KB - Virtual size: 80KB

.data
Size: 5KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 18KB - Virtual size: 17KB