NEAS[.]138dc218a1b217a1fd7d43f708477bf0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.138dc218a1b217a1fd7d43f708477bf0.exe
Size

989KB
MD5

138dc218a1b217a1fd7d43f708477bf0
SHA1

35b64be8792d44e6c44639377cabb446787e316d
SHA256

5001138f80baba261601c3446d2dee15d92a2712725506bf8a41ad671b477cea
SHA512

f3a740b77064467483effce729802258832b6c53a352866d055f6d5edd372459c839e6c427a5b0a3b91e750380e7719c63abb5ee6693a4375e91ab3377bdcec1
SSDEEP

24576:PD5KobIRq5Ik3E+Wkpqg2bZZ82NNzjLrcUZHSE5wHlXmA4WHe2QNS2VCpI5:VK4I+vFpUZZ/NNv5ue2QNS2CK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.138dc218a1b217a1fd7d43f708477bf0.exe

Files

NEAS.138dc218a1b217a1fd7d43f708477bf0.exe
.exe windows:5 windows x86 arch:x86

65d670f559e5b904a4cb818441118d3d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
GlobalGetAtomNameW
SetErrorMode
GetStartupInfoW
RtlUnwind
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapReAlloc
ExitThread
SetStdHandle
GetFileType
HeapSize
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoA
HeapCreate
GlobalReAlloc
TlsAlloc
QueryPerformanceCounter
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetTimeZoneInformation
GetTimeFormatA
GetDateFormatA
InitializeCriticalSectionAndSpinCount
LCMapStringA
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
GetCurrentDirectoryA
GetDriveTypeA
GetProcessHeap
SetEnvironmentVariableA
TlsGetValue
LocalAlloc
InterlockedCompareExchange
VirtualFree
GlobalHandle
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
VirtualProtect
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
GetLocaleInfoW
CompareStringA
InterlockedExchange
GetFileTime
GetFileSizeEx
GetFullPathNameW
GetVolumeInformationW
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
GetThreadLocale
SuspendThread
ResumeThread
SetThreadPriority
FileTimeToLocalFileTime
FindNextFileW
lstrcmpA
GetCurrentProcessId
RaiseException
FreeResource
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
LoadLibraryA
lstrcmpW
GetVersionExA
GetModuleHandleA
GlobalFree
FormatMessageW
LocalFree
MulDiv
GetFileSize
FileTimeToSystemTime
SetFileTime
GetCurrentDirectoryW
GetFileAttributesW
LocalFileTimeToFileTime
SystemTimeToFileTime
ReadFile
SetFilePointer
SetPriorityClass
DeviceIoControl
GetTickCount
TerminateProcess
CopyFileW
GetCommandLineW
RemoveDirectoryW
CreateFileW
WriteFile
VirtualFreeEx
GetCurrentProcess
CreateEventW
GlobalAlloc
GlobalLock
GlobalUnlock
ExitProcess
OutputDebugStringW
lstrcpyW
InterlockedIncrement
WritePrivateProfileStringW
WaitForSingleObject
GetModuleFileNameW
GetTempPathW
SetFileAttributesW
WriteProcessMemory
GetWindowsDirectoryW
GetSystemDirectoryW
lstrlenW
lstrlenA
CreateDirectoryW
FindClose
FindFirstFileW
InterlockedDecrement
GetVersionExW
DeleteFileW
Sleep
MoveFileW
MultiByteToWideChar
OpenProcess
VirtualAllocEx
SetEvent
CreateThread
CloseHandle
GetPrivateProfileStringW
GetLastError
SetLastError
LoadLibraryW
FreeLibrary
WideCharToMultiByte
FindResourceW
LoadResource
LockResource
SizeofResource
GetModuleHandleW
GetProcAddress

user32

GetSysColorBrush
IsRectEmpty
SetWindowContextHelpId
MapDialogRect
ShowOwnedPopups
PostQuitMessage
CharNextW
CharUpperW
GetMessageW
ValidateRect
SystemParametersInfoW
DestroyMenu
GetMenuItemInfoW
MoveWindow
SetWindowTextW
IsDialogMessageW
SetDlgItemTextW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuW
EnableMenuItem
GetActiveWindow
CreateDialogIndirectParamW
IsWindowEnabled
GetNextDlgTabItem
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
RemovePropW
GetFocus
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetLastActivePopup
SetActiveWindow
DispatchMessageW
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
PeekMessageW
CopyAcceleratorTableW
MessageBeep
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
CreateWindowExW
GetClassInfoExW
RegisterClassW
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetMenu
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetSysColor
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
ClientToScreen
GrayStringW
DrawTextExW
TabbedTextOutW
GetMenuState
SetWindowRgn
GetWindowRect
EnableWindow
PostMessageW
wsprintfW
DrawTextW
GetDlgItem
GetParent
ShowWindow
GetClassInfoW
GetMenuItemID
GetMenuItemCount
CheckMenuItem
AppendMenuW
CreatePopupMenu
InflateRect
LoadIconW
UpdateWindow
DrawIcon
SetRect
InvalidateRgn
UnregisterClassW
SetRectEmpty
PostThreadMessageW
RegisterClipboardFormatW
UnpackDDElParam
ReuseDDElParam
LoadAcceleratorsW
InsertMenuItemW
BringWindowToTop
MapWindowPoints
TranslateAcceleratorW
TranslateMessage
GetClientRect
GetNextDlgGroupItem
ScrollWindow
InvalidateRect
SetWindowLongW
GetWindowLongW
IsWindow
LoadImageW
ScreenToClient
SendMessageW
GetMessagePos
CopyRect
PtInRect
OffsetRect
LoadBitmapW
FillRect
IsWindowVisible
SetTimer
SetCapture
LoadCursorW
ReleaseCapture
GetCursorPos
GetDC
GetWindow
GetDesktopWindow
GetWindowThreadProcessId
SetPropW
GetPropW
MessageBoxW
SendMessageTimeoutW
GetClassNameW
GetSubMenu
LoadMenuW
KillTimer
FindWindowW
SetForegroundWindow
GetForegroundWindow
IsIconic
SetCursor
EnumWindows
FindWindowExW
MessageBoxExW
EndDialog
SetWindowPos
GetSystemMetrics
CloseWindow

gdi32

ExtSelectClipRgn
CreatePatternBrush
CreateBitmap
CreateSolidBrush
GetBkColor
GetTextColor
GetMapMode
CreateEllipticRgn
Ellipse
GetRgnBox
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetWindowExtEx
CreateRectRgnIndirect
CreateRoundRectRgn
MoveToEx
LineTo
GetClipBox
SetMapMode
SetTextColor
SetBkMode
SetBkColor
RestoreDC
SaveDC
GetDeviceCaps
LPtoDP
CreateFontIndirectW
DeleteDC
GetStockObject
GetPixel
GetTextExtentPoint32W
Rectangle
CreateCompatibleBitmap
SelectObject
GetObjectW
DeleteObject
BitBlt
CreateCompatibleDC
GetViewportExtEx

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

advapi32

RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
RegOpenKeyW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges

shell32

DragFinish
ShellExecuteExW
Shell_NotifyIconW
ShellExecuteW
SHGetFolderPathW
DragQueryFileW
SHGetSpecialFolderPathW

shlwapi

PathIsUNCW
PathFindExtensionW
PathFindFileNameW
UrlUnescapeW
PathStripToRootW

oledlg

OleUIBusyW

ole32

CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleUninitialize
OleFlushClipboard
CoRegisterMessageFilter
CoUninitialize
CoCreateInstance
OleRun
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoDisconnectObject
CLSIDFromString
CoTaskMemAlloc
CoSetProxyBlanket
CoInitializeSecurity
CoTaskMemFree
CLSIDFromProgID
CoInitializeEx
OleIsCurrentClipboard
CoInitialize

oleaut32

VariantInit
VariantClear
VariantCopy
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysStringLen
VariantChangeType
SysAllocStringLen
SafeArrayDestroy
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
DispCallFunc
LoadRegTypeLi
OleCreateFontIndirect
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetElemsize
SafeArrayCreate
SysFreeString
VariantTimeToSystemTime
SystemTimeToVariantTime
LoadTypeLi
GetErrorInfo

wininet

HttpOpenRequestW
InternetConnectW
HttpSendRequestW
InternetWriteFile
InternetSetFilePointer
InternetGetLastResponseInfoW
HttpAddRequestHeadersW
InternetQueryDataAvailable
InternetSetOptionExW
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetCheckConnectionW
InternetGetConnectedState
InternetCloseHandle
InternetReadFile
InternetOpenUrlW
InternetOpenW
InternetSetStatusCallbackW
InternetSetOptionW
HttpQueryInfoW

psapi

EnumProcesses
GetModuleFileNameExW
EnumProcessModules

wsock32

WSAStartup
WSACleanup
WSASetLastError

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 577KB - Virtual size: 576KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 133KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 263KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

65d670f559e5b904a4cb818441118d3d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

oledlg

ole32

oleaut32

wininet

psapi

wsock32

iphlpapi

Sections

.text Size: 577KB - Virtual size: 576KB

.rdata Size: 133KB - Virtual size: 133KB

.data Size: 14KB - Virtual size: 31KB

.rsrc Size: 263KB - Virtual size: 263KB

.text
Size: 577KB - Virtual size: 576KB

.rdata
Size: 133KB - Virtual size: 133KB

.data
Size: 14KB - Virtual size: 31KB

.rsrc
Size: 263KB - Virtual size: 263KB