NEAS[.]f258b8d5c572131b8220935b740fc450[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.f258b8d5c572131b8220935b740fc450.exe
Size

7.3MB
MD5

f258b8d5c572131b8220935b740fc450
SHA1

b99095f42a2aec3a708c6edeeff5f85f68e76f56
SHA256

9c4704387b109dcdfcb69dd465a9cb44e473036dbc4562d3bcb1b0bcfb7fc687
SHA512

1a1d1790b670179fb0970e2974354517740a20402737eef532833a26e6acfcf5fc45f7f2277b1057e9d77a27ffdaed3c33aafdf313230732fbaed75569c23ac9
SSDEEP

98304:jgSEZEM/Ke3IW45QrjFuTZNGBDA6o77If:rEZEqwTZNqysf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.f258b8d5c572131b8220935b740fc450.exe

Files

NEAS.f258b8d5c572131b8220935b740fc450.exe
.exe windows:6 windows x64 arch:x64

d9972912fe972e82ea72112828f4bd60

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

bcrypt

BCryptGenRandom

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey
SystemFunction036

kernel32

GetCurrentProcess
GetSystemInfo
CreateIoCompletionPort
AcquireSRWLockShared
GetQueuedCompletionStatusEx
ReleaseSRWLockShared
PostQueuedCompletionStatus
GetCurrentProcessId
SetHandleInformation
SetFileCompletionNotificationModes
Sleep
GetModuleHandleA
GetProcAddress
SetConsoleCursorPosition
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
ReleaseMutex
FindClose
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
GetCurrentThread
RtlCaptureContext
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
IsProcessorFeaturePresent
GetCommandLineW
SetFilePointerEx
WaitForSingleObject
TerminateProcess
WakeConditionVariable
QueryPerformanceCounter
QueryPerformanceFrequency
HeapAlloc
GetProcessHeap
HeapFree
GetCurrentThreadId
HeapReAlloc
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
CreateFileW
GetFileInformationByHandle
CreateDirectoryW
FindFirstFileW
DeleteFileW
GetFinalPathNameByHandleW
GetFileType
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
ExitProcess
GetFullPathNameW
MultiByteToWideChar
WriteConsoleW
CreateThread
GetSystemTimeAsFileTime
SetConsoleMode
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
GetFileInformationByHandleEx
GetConsoleMode
GetStdHandle
TryAcquireSRWLockExclusive
lstrlenW
InitializeSListHead
IsDebuggerPresent
CloseHandle
AcquireSRWLockExclusive
ReleaseSRWLockExclusive

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

ws2_32

WSASend
send
recv
shutdown
getsockopt
ioctlsocket
connect
bind
WSASocketW
getpeername
getsockname
setsockopt
WSAIoctl
WSAGetLastError
WSAStartup
WSACleanup
freeaddrinfo
getaddrinfo
closesocket

secur32

AcceptSecurityContext
InitializeSecurityContextW
FreeCredentialsHandle
AcquireCredentialsHandleA
DecryptMessage
ApplyControlToken
DeleteSecurityContext
FreeContextBuffer
EncryptMessage
QueryContextAttributesW

crypt32

CertDuplicateCertificateChain
CertFreeCertificateChain
CertEnumCertificatesInStore
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertAddCertificateContextToStore
CertOpenStore
CertCloseStore
CertDuplicateStore
CertFreeCertificateContext
CertDuplicateCertificateContext

ntdll

NtCancelIoFileEx
NtCreateFile
NtDeviceIoControlFile
RtlNtStatusToDosError
NtReadFile
NtWriteFile

vcruntime140

__C_specific_handler
_CxxThrowException
memmove
memset
memcmp
memcpy
__CxxFrameHandler3
__current_exception
__current_exception_context

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-heap-l1-1-0

free
malloc
_set_new_mode

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_seh_filter_exe
_set_app_type
terminate
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
_initialize_onexit_table
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_crt_atexit

api-ms-win-crt-math-l1-1-0

round
__setusermatherr
trunc
pow
ceil
truncf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 221KB - Virtual size: 221KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d9972912fe972e82ea72112828f4bd60

Headers

DLL Characteristics

File Characteristics

Imports

bcrypt

advapi32

kernel32

shell32

ole32

ws2_32

secur32

crypt32

ntdll

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 4.5MB - Virtual size: 4.5MB

.rdata Size: 2.5MB - Virtual size: 2.5MB

.data Size: 16KB - Virtual size: 17KB

.pdata Size: 221KB - Virtual size: 221KB

.reloc Size: 64KB - Virtual size: 64KB

.text
Size: 4.5MB - Virtual size: 4.5MB

.rdata
Size: 2.5MB - Virtual size: 2.5MB

.data
Size: 16KB - Virtual size: 17KB

.pdata
Size: 221KB - Virtual size: 221KB

.reloc
Size: 64KB - Virtual size: 64KB