NEAS[.]e5c68e7d016a5eda39e37d09ce82bfa0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.e5c68e7d016a5eda39e37d09ce82bfa0.exe
Size

273KB
MD5

e5c68e7d016a5eda39e37d09ce82bfa0
SHA1

0c8957e14081b6839c96fbd7eeebc1a6fc134d34
SHA256

188ada5ebeb93ed512b05900a90256514f76535cd30fb728f54acaf8041e6c42
SHA512

87c5498ebecbd7472a08b1feafc522490d3fcec944b9227b69e77f9b48eb1471224e9fc70813d3a34ff0d9e8c259a6deb3b839c4cb97ba5478bf9dfda0051ee3
SSDEEP

6144:MSBQBzvQaVLw98zAn2wqJHDrReLn/v8xbp:OLwyzXwqJjcT/vMp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.e5c68e7d016a5eda39e37d09ce82bfa0.exe

Files

NEAS.e5c68e7d016a5eda39e37d09ce82bfa0.exe
.dll windows:5 windows x86 arch:x86

e0a1775ee3a23a6c40a086325e4b37b0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

librfc32

ItLeng
RfcClose
RfcGetFunctionInfoAsTable
RfcLastErrorEx
RfcConvertCharToBcd
RfcConvertBcdToChar
RfcCallReceiveEx
ItAppLine
RfcOpenEx
ItCreate
RfcGetStructureInfoAsTable
ItDelete
ItGetLine
ItFill

cxresmgrx70

Initialize
Deinitialize
RMLoadString

kernel32

CompareStringW
GetLocaleInfoW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GlobalFlags
DeleteFileW
CreateFileW
FindClose
FindFirstFileW
FlushFileBuffers
GetFullPathNameW
GetVolumeInformationW
WriteFile
GetCurrentProcess
FileTimeToLocalFileTime
GetFileAttributesExW
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
RtlUnwind
ExitProcess
GetModuleHandleExW
HeapQueryInformation
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
GetStartupInfoW
IsValidCodePage
GetOEMCP
GetCPInfo
GetStringTypeW
GetStdHandle
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
SetFilePointerEx
OutputDebugStringW
LCMapStringW
SetStdHandle
WriteConsoleW
SetEnvironmentVariableA
FileTimeToSystemTime
SetErrorMode
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
GlobalFindAtomW
LoadLibraryA
GetSystemDirectoryW
LeaveCriticalSection
EnterCriticalSection
EncodePointer
GetCurrentProcessId
GlobalAddAtomW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
WaitForSingleObject
CloseHandle
lstrcmpW
lstrcmpA
GlobalDeleteAtom
LoadLibraryExW
FreeLibrary
GetVersionExW
GetCurrentThreadId
GetCurrentThread
FindResourceW
FormatMessageW
LocalFree
SizeofResource
LockResource
LoadResource
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
SetLastError
OutputDebugStringA
GetACP
DeleteCriticalSection
DecodePointer
HeapSize
GetLastError
RaiseException
InitializeCriticalSectionAndSpinCount
GetProcessHeap
HeapFree
HeapAlloc
HeapReAlloc
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalFree
WideCharToMultiByte
IsDBCSLeadByte
MultiByteToWideChar

user32

GetClassNameW
GetClassLongW
SetWindowLongW
PtInRect
CopyRect
GetSysColor
MapWindowPoints
ScreenToClient
AdjustWindowRectEx
GetWindowRect
GetClientRect
RemovePropW
GetPropW
SetPropW
RedrawWindow
SetForegroundWindow
GetForegroundWindow
UpdateWindow
SetMenu
GetMenu
GetCapture
GetDlgCtrlID
GetDlgItem
SetWindowPos
DestroyWindow
IsWindow
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
GetMessageTime
GetMessagePos
RegisterWindowMessageW
GetLastActivePopup
GetWindowThreadProcessId
GetWindowLongW
IsWindowEnabled
EnableWindow
SetCursor
CallNextHookEx
SetWindowsHookExW
GetCursorPos
ValidateRect
GetKeyState
GetActiveWindow
IsWindowVisible
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetFocus
SendMessageW
PostQuitMessage
PostMessageW
TabbedTextOutW
GetMenuItemCount
GetMenuItemID
GetSubMenu
UnhookWindowsHookEx
GetParent
UnregisterClassW
MessageBoxW
MessageBoxA
GrayStringW
DestroyMenu
CharUpperW
GetWindowTextW
DrawTextExW
DrawTextW
InvalidateRect
KillTimer
SetTimer
RealChildWindowFromPoint
ClientToScreen
LoadCursorW
GetSysColorBrush
ReleaseDC
GetDC
GetSystemMetrics
SetWindowTextW
ShowWindow
GetMonitorInfoW
MonitorFromWindow
WinHelpW
LoadIconW
GetWindow
GetTopWindow

gdi32

DeleteDC
Escape
GetClipBox
GetStockObject
PtVisible
RectVisible
RestoreDC
SaveDC
SelectObject
SetMapMode
TextOutW
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
OffsetViewportOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
DeleteObject
SetTextColor
SetBkColor
CreateBitmap
GetDeviceCaps

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

advapi32

RegQueryValueW
RegEnumKeyW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegEnumValueW

shell32

ShellExecuteW

shlwapi

PathIsUNCW
PathStripToRootW
PathFindExtensionW
PathFindFileNameW

ole32

CoTaskMemFree
CoUninitialize
CoCreateGuid
CoCreateInstance
CoInitialize

oleaut32

VariantChangeType
VariantClear
VariantInit
SysAllocString
SysFreeString

oleacc

LresultFromObject
CreateStdAccessibleObject

Exports

Exports

?hrcAllocMemory@@YGPAEH@Z
?hrcGetInfoSP@@YGFPAXPAG@Z
hrcColumnInfo
hrcColumnList
hrcConnect
hrcDisconnect
hrcDisconnectAll
hrcExecSapRfc
hrcExecSapTable
hrcFetch
hrcFreeMemory
hrcFreeStmt
hrcGetBlob
hrcGetErrMsg
hrcGetExportData
hrcGetSapColumn
hrcGetSapFunction
hrcGetSapRfcColumn
hrcGetSapRfcParam
hrcGetSapTable
hrcMakeSelectQuery
hrcSelectQuery
hrcSelectedColInfo
hrcTableList

Sections

.text
Size: 193KB - Virtual size: 193KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e0a1775ee3a23a6c40a086325e4b37b0

Headers

DLL Characteristics

File Characteristics

Imports

librfc32

cxresmgrx70

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

oleacc

Exports

Exports

Sections

.text Size: 193KB - Virtual size: 193KB

.rdata Size: 54KB - Virtual size: 53KB

.data Size: 9KB - Virtual size: 25KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 13KB - Virtual size: 13KB

.text
Size: 193KB - Virtual size: 193KB

.rdata
Size: 54KB - Virtual size: 53KB

.data
Size: 9KB - Virtual size: 25KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 13KB - Virtual size: 13KB