NEAS[.]78bd94853171e6f044bceea87b883ed0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.78bd94853171e6f044bceea87b883ed0.exe
Size

1.5MB
MD5

78bd94853171e6f044bceea87b883ed0
SHA1

b12a5187ccad3aca7f3f3a2de7fda13c58861343
SHA256

fe757a1b4a8d3384ca292052d771cd40b68f9613b412782e919deba917f4cc86
SHA512

f71fd922884a81d742d4c3857f55bf3964f900083eae59d6440d835fde488f910eecffc9c23f90dd63e724e5133030222b353b1131a4cb012f57e370e413d653
SSDEEP

12288:AVT4Y9Dmz56zAbdgCjwAJAYBjvrEH7FMH:SZE5OcwGFrEH7FA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.78bd94853171e6f044bceea87b883ed0.exe

Files

NEAS.78bd94853171e6f044bceea87b883ed0.exe
.exe windows:5 windows x86 arch:x86

5da3df3a3dedc94b321961384089c297

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenProcess
DuplicateHandle
WaitForMultipleObjectsEx
SleepEx
FindClose
GetExitCodeProcess
SetSystemPowerState
Beep
lstrcpynW
SetEvent
lstrcmpiW
LoadLibraryA
FreeLibrary
FileTimeToSystemTime
SystemTimeToFileTime
GetLocalTime
GetTimeFormatW
GetDateFormatW
MulDiv
CreateEventA
GetTickCount
SetThreadAffinityMask
GetCurrentProcess
GetProcessAffinityMask
SetLastError
GetCurrentProcessId
ProcessIdToSessionId
VirtualFree
QueryPerformanceCounter
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
lstrlenW
GlobalSize
GlobalUnlock
GetCurrentThread
GetThreadPriority
SetThreadPriority
SetHandleInformation
QueueUserAPC
ResumeThread
GetCurrentThreadId
TlsGetValue
ReleaseSemaphore
ReleaseMutex
CloseHandle
LoadLibraryW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
RtlUnwind
HeapDestroy
HeapCreate
GetSystemDirectoryA
GlobalFindAtomW
GetLocaleInfoA
CreateToolhelp32Snapshot
IsValidCodePage
OutputDebugStringA
GetFullPathNameW
FormatMessageW
GetLongPathNameW
GetShortPathNameW
SearchPathW
GetTempPathW
ExpandEnvironmentStringsW
SetEndOfFile
OpenFileMappingA
MapViewOfFile
lstrcpyW
UnmapViewOfFile
WriteFile
CreateSemaphoreA
LocalAlloc
GetPrivateProfileStringW
CreateDirectoryW
CopyFileW
MoveFileExW
DeleteFileW
GetPrivateProfileIntW
WritePrivateProfileStructW
GetPrivateProfileStructW
WritePrivateProfileStringW
CreateFileW
GetFileAttributesExW
SetFileAttributesW
GetFileAttributesW
FindNextFileW
FindFirstFileW
GetDiskFreeSpaceExA
Sleep
CreateMutexA
GetLastError
WaitForSingleObject
LoadLibraryExW
GetStartupInfoA
GetVersion
GetSystemInfo
GetModuleHandleW
GetProcAddress
VirtualAlloc
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
GetCommandLineW
GetDriveTypeA
OpenMutexA
GetComputerNameW
FindResourceW
LoadResource
LockResource
SizeofResource
WaitForSingleObjectEx
LocalFree
ReadFile
GetSystemTimeAsFileTime
GetModuleFileNameA
TlsFree
GlobalDeleteAtom
IsProcessorFeaturePresent
SetErrorMode
GlobalAddAtomA
GetModuleFileNameW
TerminateThread
TlsSetValue
TlsAlloc
QueryPerformanceFrequency
GetStringTypeExA
WideCharToMultiByte
GetModuleHandleA
RaiseException
CompareStringW
HeapFree
HeapAlloc

user32

SetClipboardViewer
SetWindowLongW
GetOpenClipboardWindow
GetClipboardSequenceNumber
RegisterClipboardFormatA
GetKeyState
IsWindowVisible
LoadImageW
CloseDesktop
GetUserObjectInformationA
OpenInputDesktop
GetProcessWindowStation
SystemParametersInfoA
GetForegroundWindow
CreatePopupMenu
GetKeyboardLayout
GetWindowThreadProcessId
SendInput
SetForegroundWindow
GetDesktopWindow
GetWindow
MapVirtualKeyExW
VkKeyScanExW
GetSystemMetrics
MonitorFromPoint
PtInRect
IsCharLowerA
IsCharUpperA
IsCharAlphaA
PostQuitMessage
GetWindowLongW
GetMenuItemInfoW
SetMenuItemInfoW
FindWindowW
EnumWindows
IsDlgButtonChecked
LockSetForegroundWindow
EndDialog
EnableWindow
wvsprintfA
InternalGetWindowText
GetWindowTextLengthW
GetWindowTextW
TrackPopupMenuEx
EndMenu
OffsetRect
RealChildWindowFromPoint
CallWindowProcW
SetClipboardData
ChangeClipboardChain
GetClipboardOwner
EmptyClipboard
GetClipboardData
CloseClipboard
OpenClipboard
PostThreadMessageA
EnumThreadWindows
SendMessageW
CreateWindowExA
SetTimer
KillTimer
DestroyWindow
DefWindowProcW
RegisterHotKey
UnregisterHotKey
CopyIcon
EnumDisplayMonitors
InvalidateRect
GetCursorPos
FindWindowA
PostMessageW
SendNotifyMessageW
IsZoomed
SetFocus
AttachThreadInput
GetGUIThreadInfo
GetTopWindow
GetLastActivePopup
IsRectEmpty
GetShellWindow
GetSystemMenu
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetMenuState
SendMessageTimeoutW
SendMessageCallbackA
IsWindowEnabled
LoadCursorA
GetCursorInfo
MsgWaitForMultipleObjectsEx
WaitForInputIdle
AllowSetForegroundWindow
LockWorkStation
ExitWindowsEx
MessageBeep
EnumChildWindows
BringWindowToTop
SetRect
RegisterWindowMessageA
PeekMessageW
DispatchMessageW
GetMessageW
GetDlgCtrlID
IsWindow
FindWindowExW
GetPropA
ReplyMessage
GetParent
GetClassLongW
GetSysColor
SetWindowPos
GetClientRect
CopyImage
CreateIconFromResourceEx
GetIconInfo
GetWindowRect
DestroyIcon
FillRect
DrawIconEx
ReleaseDC
GetDC
IsIconic
ShowWindow
CharUpperA
CharLowerA
CharLowerW
CharLowerBuffW
CharUpperBuffW
SetPropA
RemovePropA
TranslateMessage
GetMonitorInfoA
MonitorFromRect
MonitorFromWindow
MsgWaitForMultipleObjects
GetAsyncKeyState
MapVirtualKeyW
GetKeyNameTextW
MessageBoxW
MessageBoxIndirectW
DialogBoxIndirectParamA
CreateDialogIndirectParamA
DialogBoxIndirectParamW
CreateDialogIndirectParamW
CreateWindowExW
DrawTextW
InsertMenuItemW
AppendMenuW
RegisterClassExW
GetClassInfoExW
GetClassNameW
GetClassNameA
GetWindowPlacement
SetWindowPlacement
ScreenToClient
ClientToScreen
MapWindowPoints
GetDlgItem
SetWindowLongA
IsWindowUnicode
GetAncestor
IsChild
WindowFromPoint

gdi32

DeleteObject
BitBlt
SelectObject
GetDIBits
GetStockObject
CreateDIBitmap
GetDeviceCaps
GetObjectW
GetPixel
CreateCompatibleDC
DeleteDC
CreateCompatibleBitmap
CreateFontIndirectW
GetObjectA

advapi32

RegCreateKeyExW
InitiateSystemShutdownW
GetSidSubAuthorityCount
GetSidSubAuthority
RegDeleteValueW
RegDeleteKeyW
GetTokenInformation
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorA
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
GetUserNameW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

ole32

OleUninitialize
RegisterDragDrop
RevokeDragDrop
OleInitialize
CoGetClassObject
CreateStreamOnHGlobal
ReleaseStgMedium
GetRunningObjectTable
CreateBindCtx
CoCreateInstance
CLSIDFromProgID
IIDFromString
CoGetObject
CoTaskMemFree

oleaut32

VarDecFromUI2
VarDecFromUI1
VarDecFromR8
VarDecFromI4
VarDecFromUI4
VarCyFromStr
VarCyFromR4
VarCyFromDate
VarCyFromDec
VarCyFromUI2
VarCyFromUI1
VarCyFromR8
VarCyFromI4
VarCyFromUI4
VarDateFromR4
VarDateFromDec
VarDateFromCy
VarDateFromUI2
VarDateFromUI1
VarDateFromR8
VarDateFromI4
VarDateFromUI4
SafeArrayCreate
VarBstrFromR4
VarBstrFromDec
VarBstrFromCy
VarBstrFromDate
VarDecAdd
VarDecSu
VarDecMul
VarDecDiv
VarDecFix
VarDecCmp
VarCyAdd
VarCySu
VarCyMul
VarCyRound
VarCyFix
VarCyCmp
VarAdd
VarSu
VarMul
VarDiv
VarRound
VarFix
VarCmp
VarBstrCat
VarBstrCmp
SysAllocStringLen
SysReAllocStringLen
SysStringLen
GetActiveObject
SafeArrayAllocData
SafeArrayGetDim
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayUnlock
SafeArrayLock
SafeArrayPtrOfIndex
OleCreateFontIndirect
VariantInit
VarBstrFromR8
VarDateFromStr
VarR8Round
SysFreeString
SafeArrayDestroy
VariantClear
SysReAllocString
SafeArrayDestroyDescriptor
SysAllocString
GetErrorInfo
SafeArrayRedim
SafeArrayAllocDescriptor
OleLoadPicture
OleCreatePictureIndirect
VarUdateFromDate
SystemTimeToVariantTime
SafeArrayCopy
VariantCopy
SafeArrayGetVartype
SafeArrayCreateEx
VarCyNeg
VarDecNeg
VarNeg
VarDecFromCy
VarDecFromDate
VarDecFromR4
VarDecFromStr
VarR4FromCy
VarR4FromDec
VarR4FromDate
VarNot
VarI4FromR4
VarI4FromDec
VarI4FromCy
VarI4FromDate
VarI4FromStr
VariantChangeTypeEx
VarDecRound
VariantTimeToSystemTime
VarR8FromDec
VarR8FromCy
VarR8FromStr
VarR4FromStr

winmm

timeBeginPeriod
timeEndPeriod
timeGetTime
PlaySoundW

shlwapi

StrChrW
PathFindFileNameA
ord158
StrCatW
StrCmpW
StrCmpIW
PathGetArgsW
StrStrIW
SHDeleteKeyW
SHDeleteEmptyKeyW
SHCreateStreamOnFileW
StrRChrA
StrRetToStrW
PathSkipRootA

comctl32

InitCommonControlsEx
ImageList_GetIcon
ImageList_Add
ImageList_Create

msvcrt

__CxxFrameHandler
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
_acmdln
_XcptFilter
_cexit
__getmainargs
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
??1type_info@@UAE@XZ
_ismbblead
isspace
isxdigit
isgraph
isprint
ispunct
iscntrl
strncmp
abs
exit
strstr
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
?_set_new_mode@@YAHH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_beginthreadex
_endthreadex
_CxxThrowException
memchr
strlen
malloc
realloc
calloc
free
_msize
_except_handler3
_strtime
_strdate
_ultoa
_i64toa
strcpy
fabs
sqrt
memmove
_itoa
strrchr
memcmp
memcpy
_exit
memset
strchr

shell32

SHGetDesktopFolder
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderPathW
SHFileOperationW
SHChangeNotify
ShellExecuteExW
SHGetFileInfoW
SHBindToParent
SHGetSpecialFolderLocation

Exports

Exports

AdjustWindowPos
AllowActivateWindows
AutoSizeControls
Brac2
ConvertSignedUnsigned
Crc32
CreateCsScript
CreateCsv
CreateEnumFiles
CreateFileU
CreateRegExpMenu
CreateShortcutEx
CreateStringMap
CreateXml
DetectStringEncoding
DialogBoxIndirectParamU
DpiClientToScreen
DpiGetDPI
DpiGetWindowRect
DpiIsWindowScaled
DpiMapWindowPoints
DpiScale
DpiScreenToClient
DrawTextU
EditReplaceSel
EnsureLoggedOn
EnumProcessesEx
EnumQmThreads
ExeExtractFile
ExeGetResourceData
FileExists
FindFirstFileU
FindNextFileU
FormatKeyString
GetCPU
GetCallStack
GetDiskUsage
GetExeResHandle
GetFileIcon
GetFileOrFolderSize
GetFullPath
GetMod
GetProcessExename
GetProcessIntegrityLevel
GetProcessUacInfo
GetQmThreadInfo
GetSecurityAttributes
GetShortcutInfoEx
GetToolbarOwner
GetUserInfo
GetWindowIcon
HtmlHelpU
InitWindowsDll
InsertMenuItemU
InterfaceForDll
IsExtendedKey
IsHungWindow
IsLoggedOn
IsThreadRunning
IsUserAdmin
IsValidCallback
IsWindow64Bit
LoadPictureFile
MemCompare
MenuGetString
MenuSetString
MonitorFromIndex
MonitorIndex
PerfFirst
PerfNext
PerfOut
PidlFromStr
PidlToStr
ProcessHandleToId
ProcessNameToId
QmKeyCodeFromVK
QmKeyCodeToVK
QmRegisterDropTarget
QmSetWindowClassFlags
QmUnregisterDropTarget
RandomInt
RandomNumber
RealGetKeyState
RealGetNextWindow
RealGetParent
RedirectQmOutput
RegisterComComponent
RichEditLoad
RichEditSave
Round
RtOptions
SaveBitmap
SelStr
SetPrivilege
SetWinStyle
StrCompare
StrCompareEx
StrCompareN
SubclassWindow
WaitForAnActiveWindow
__CDD_CanHaveText
__CDD_LoadControlDllOnDemand
__CompileDialogDefinition
__Crc
__GetQmItemIcon
__ImageListLoad
__SfMap
__Str_GetNotThis
__SysLinkOnClick
__Test
__TrackPopupMenu
__Val
__VarProp_Get
__VarProp_GetVar
__VarProp_Remove
__VarProp_Set
q_calloc
q_free
q_isalnum
q_iscsym
q_isdigit
q_malloc
q_memicmp
q_msize
q_printf
q_realloc
q_sort
q_strdup
q_stricmp
q_strnicmp

Sections

.text
Size: 316KB - Virtual size: 316KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5da3df3a3dedc94b321961384089c297

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

winmm

shlwapi

comctl32

msvcrt

shell32

Exports

Exports

Sections

.text Size: 316KB - Virtual size: 316KB

.rdata Size: 60KB - Virtual size: 60KB

.data Size: 3KB - Virtual size: 13KB

.rsrc Size: 1.1MB - Virtual size: 1.1MB

.text
Size: 316KB - Virtual size: 316KB

.rdata
Size: 60KB - Virtual size: 60KB

.data
Size: 3KB - Virtual size: 13KB

.rsrc
Size: 1.1MB - Virtual size: 1.1MB