NEAS[.]f85b808bfc7ead2939cdb3692386db10[.]exe

General

Target

NEAS.f85b808bfc7ead2939cdb3692386db10.exe
Size

784KB
MD5

f85b808bfc7ead2939cdb3692386db10
SHA1

672b725315bb8ecf335e186dd6d70ea2d886196e
SHA256

4fd3e1dc8a49c259c9f67c857bb5a3a5c21adaaee38c2a62fd6be9e1ab57666b
SHA512

beb5e2d0ccc734445927c578fc5898743e55657a9df9cdd3413c5d4fa4f896d4a249c4aa5de8e7adee4e4993b8ab864862a3c8e6384c8430f0ef8ba4cf622345
SSDEEP

24576:MG6BEWaiCa6sFkmf0al2fbtrqE72WP2ypU:MJqS6sFf8acfbH7RZp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.f85b808bfc7ead2939cdb3692386db10.exe

Files

NEAS.f85b808bfc7ead2939cdb3692386db10.exe
.dll windows:4 windows x86 arch:x86

1e23b102b43b96102b9c177f90d013ee

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA

kernel32

SetLastError
GetStringTypeW
GetStringTypeA
OpenFileMappingA
MapViewOfFile
RtlMoveMemory
CloseHandle
LoadLibraryA
lstrcpyn
MultiByteToWideChar
DeviceIoControl
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
LCMapStringA
WriteFile
CreateFileA
SetFileAttributesA
MoveFileA
DeleteFileA
FreeLibrary
GetProcAddress
GetCommandLineA
GetVersion
InterlockedDecrement
InterlockedIncrement
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
LCMapStringW
VirtualAlloc
RtlUnwind
GetCPInfo
GetACP
GetOEMCP

shlwapi

PathFileExistsA

Exports

Exports

_��ӳ��

Sections

.text
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 744KB - Virtual size: 745KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1e23b102b43b96102b9c177f90d013ee

Headers

File Characteristics

Imports

user32

kernel32

shlwapi

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 21KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 744KB - Virtual size: 745KB

.reloc Size: 8KB - Virtual size: 5KB

.text
Size: 24KB - Virtual size: 21KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 744KB - Virtual size: 745KB

.reloc
Size: 8KB - Virtual size: 5KB