NEAS[.]b16e7fd42a23710576ff6b7d9413dad0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.b16e7fd42a23710576ff6b7d9413dad0.exe
Size

4.5MB
MD5

b16e7fd42a23710576ff6b7d9413dad0
SHA1

b8f38092afd6d2e1200eae512b43c0533486f01d
SHA256

d5ee7421f4d69b75d0f5be1bcab2ead184abfbe6f49020e8856963e5407f8f4e
SHA512

33bc046684ccd8f17c359054dbc4ec5a3f7527e98285da115b73e4df58a51f120fe8dc7772f07008d3deae7c579530d462706bc2edbefe9fc956efeaf2618381
SSDEEP

98304:jZCk5ZjXckSKCqcfIPNnw8CncZhaunt2n5C/E1zk7Vx390xwx:jZCk0lmuI2cZ0utu8czWVxN/x

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.b16e7fd42a23710576ff6b7d9413dad0.exe

Files

NEAS.b16e7fd42a23710576ff6b7d9413dad0.exe
.exe windows:5 windows x86 arch:x86

dfc8645270ceb59f393a21b56cbd94ee

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetWaitableTimer
CreateToolhelp32Snapshot
Process32First
Process32Next
IsWow64Process
VirtualAllocEx
WriteProcessMemory
WaitForSingleObject
GetExitCodeThread
GetModuleFileNameW
GetEnvironmentVariableW
SetPriorityClass
GetCurrentThread
SetThreadPriority
ExitProcess
MultiByteToWideChar
GetCurrentProcessId
GlobalAlloc
GlobalFree
lstrlenW
WideCharToMultiByte
CreateWaitableTimerA
GetTempPathW
QueryDosDeviceW
TerminateProcess
GetProcessHeap
GetModuleHandleA
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
ReadFile
GetFileSize
CreateFileA
DeleteFileA
GetEnvironmentVariableA
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
RtlMoveMemory
CloseHandle
lstrcpyn
OpenProcess
GetCurrentProcess
Module32First
OpenEventA
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

TranslateMessage
wsprintfA
MessageBoxA
MsgWaitForMultipleObjects
DispatchMessageA
GetMessageA
PeekMessageA

advapi32

OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA

shell32

ShellExecuteExW
SHGetSpecialFolderPathW
SHChangeNotify

psapi

GetProcessImageFileNameW

msvcrt

realloc
calloc
strstr
malloc
_stricmp
sprintf
atoi
_ftol
strrchr
strchr
free

shlwapi

PathFileExistsA

oleaut32

VariantTimeToSystemTime

Sections

.text
Size: - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pn0
Size: - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.(n(
Size: 1024B - Virtual size: 756B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.%pv
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dfc8645270ceb59f393a21b56cbd94ee

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

psapi

msvcrt

shlwapi

oleaut32

Sections

.text Size: - Virtual size: 66KB

.rdata Size: - Virtual size: 5KB

.data Size: - Virtual size: 180KB

.pn0 Size: - Virtual size: 1.7MB

.(n( Size: 1024B - Virtual size: 756B

.%pv Size: 3.7MB - Virtual size: 3.7MB

.text
Size: - Virtual size: 66KB

.rdata
Size: - Virtual size: 5KB

.data
Size: - Virtual size: 180KB

.pn0
Size: - Virtual size: 1.7MB

.(n(
Size: 1024B - Virtual size: 756B

.%pv
Size: 3.7MB - Virtual size: 3.7MB