NEAS[.]8ca0042e3a2c1aba55e64ca29f37d57d3771f28342c07265bf8ca086f4671822[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.8ca0042e3a2c1aba55e64ca29f37d57d3771f28342c07265bf8ca086f4671822.exe
Size

234KB
MD5

eec9ea262995c07e42e560fd18a6850a
SHA1

399d6340960ac20f307549631b7db74198de4afa
SHA256

8ca0042e3a2c1aba55e64ca29f37d57d3771f28342c07265bf8ca086f4671822
SHA512

b95b353a9053ff24934c42d6d85ab1960fea5532615a8a07a05433554dd6fbcab277ce0d14efdeafa6d52c532b43eb371c5bb39bc9c7861f0de82325ae05d1e8
SSDEEP

3072:9db6eeptBFdM84ZWroc3WccOIOyMxK2JtbLoQtUQrIfBcCgOOuN4eAg0FujjZAMZ:9dbItST4xcOjyMsStoQtUDfP7AOvZBX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.8ca0042e3a2c1aba55e64ca29f37d57d3771f28342c07265bf8ca086f4671822.exe

Files

NEAS.8ca0042e3a2c1aba55e64ca29f37d57d3771f28342c07265bf8ca086f4671822.exe
.exe windows:6 windows x86 arch:x86

4d9ccf1fce9e51c2875886b4fcf753c9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

imm32

ImmSetCompositionFontW
ImmGetIMEFileNameA
ImmAssociateContext
ImmGetCandidateListW
ImmReSizeIMCC
ImmSimulateHotKey
ImmGetCandidateWindow
ImmGetRegisterWordStyleA
ImmIsUIMessageA
ImmIsIME
ImmSetCandidateWindow

kernel32

DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetTempPathW
VirtualAlloc
EnumSystemCodePagesW
GetConsoleWindow
WriteConsoleW
HeapSize
CreateFileW
ReadConsoleW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetProcessHeap
SetFilePointerEx
GetFileSizeEx
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetCommandLineW
GetCommandLineA
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
ExitProcess
HeapReAlloc
HeapFree
HeapAlloc
LoadLibraryExW
FreeLibrary
GetLastError
RtlUnwind
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
GetCurrentProcess
TerminateProcess
RaiseException
SetEndOfFile

resutils

ResUtilGetPrivateProperties
ResUtilGetBinaryProperty
ResUtilStartResourceService
ResUtilSetBinaryValue
ResUtilSetPrivatePropertyList
ResUtilIsPathValid
ResUtilDupParameterBlock
ResUtilGetSzProperty
ResUtilGetProperty
ResUtilSetPropertyTable
ResUtilGetEnvironmentWithNetName
ClusWorkerCheckTerminate

shell32

FindExecutableW
DoEnvironmentSubstW
DragQueryFile
ShellExecuteExW

urlmon

IsValidURL
RevokeBindStatusCallback
ReleaseBindInfo
CoInternetCompareUrl
RegisterMediaTypeClass
GetClassURL
URLOpenPullStreamA

ole32

UtGetDvtd32Info
HWND_UserUnmarshal
OleCreateLinkToFile
GetHGlobalFromILockBytes
SNB_UserFree
OleQueryCreateFromData
HWND_UserMarshal
EnableHookObject
OleBuildVersion
WriteClassStg
HWND_UserFree

loadperf

LoadPerfCounterTextStringsA
UnloadPerfCounterTextStringsW
LoadPerfCounterTextStringsW
UnloadPerfCounterTextStringsA

user32

ShowWindow

Sections

.text
Size: 154KB - Virtual size: 153KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 656B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4d9ccf1fce9e51c2875886b4fcf753c9

Headers

DLL Characteristics

File Characteristics

Imports

imm32

kernel32

resutils

shell32

urlmon

ole32

loadperf

user32

Sections

.text Size: 154KB - Virtual size: 153KB

.rdata Size: 67KB - Virtual size: 67KB

.data Size: 10KB - Virtual size: 14KB

.gfids Size: 1024B - Virtual size: 656B

.tls Size: 512B - Virtual size: 9B

.text
Size: 154KB - Virtual size: 153KB

.rdata
Size: 67KB - Virtual size: 67KB

.data
Size: 10KB - Virtual size: 14KB

.gfids
Size: 1024B - Virtual size: 656B

.tls
Size: 512B - Virtual size: 9B