NEAS[.]fd1ffa3f78fa068d9c171661d4cc92c0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.fd1ffa3f78fa068d9c171661d4cc92c0.exe
Size

50KB
MD5

fd1ffa3f78fa068d9c171661d4cc92c0
SHA1

41b416c92a3a784f73cf3f2756e6b19297ea7d7b
SHA256

3c1e8e0764bdf10b756647c7d3e46d4d613f8f3331089e192e1873ad2f9aec71
SHA512

beb1f73125599c8acac1daf2006a6f6fc2183a3eecac46ef1d93e25d555679d098c718fc1e5df3ddaab0ee52febd11dc15e3a65218b35ab73b46bd1d128a7e93
SSDEEP

1536:MADPjxx7tt93F2l/W0kQBT/jhBLxW217:tPjbtt9VS/WkVBP1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.fd1ffa3f78fa068d9c171661d4cc92c0.exe

Files

NEAS.fd1ffa3f78fa068d9c171661d4cc92c0.exe
.dll windows:4 windows x86 arch:x86

b9019c5d4a8f4a8364504213e88df6e6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ilock

wsprintfA

user32

MessageBoxA
FillRect

kernel32

lstrcpyA
GetProcAddress
GetModuleFileNameA
TlsSetValue
TlsFree
FreeLibrary
GetModuleHandleA
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetLastError
GetLastError
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
LoadLibraryExW
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter

gdi32

EndPage
ExtTextOutW
ExtTextOutA
TextOutW
TextOutA
GetTextMetricsW
GetTextMetricsA
GetTextExtentPoint32W
GetTextExtentPoint32A
SelectObject
SetBkMode
SetBkColor
GetDeviceCaps
SetViewportOrgEx
SetMapMode
DPtoLP
LPtoDP
StartDocA
EndDoc
StartPage
MoveToEx
LineTo
Rectangle
Polygon
PolyPolygon
SetTextAlign
SetTextColor

winspool.drv

DeviceCapabilitiesA
DocumentPropertiesA
OpenPrinterA
ClosePrinter
GetPrinterA

minvc

strchr
strrchr
__CxxFrameHandler3
memcpy
strstr
memset
__std_exception_copy
_CxxThrowException
__std_type_info_destroy_list
_except_handler4_common
__std_exception_destroy

minucrt

_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_seh_filter_dll
_calloc_base
_free_base
qsort
itoa
atoi
__stdio_common_vsprintf
free
_initterm_e
_initterm
malloc
_callnewh
mkdir
_errno
_time32

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b9019c5d4a8f4a8364504213e88df6e6

Headers

DLL Characteristics

File Characteristics

Imports

ilock

user32

kernel32

gdi32

winspool.drv

minvc

minucrt

Sections

.text Size: 31KB - Virtual size: 30KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 5KB - Virtual size: 7KB

.gfids Size: 512B - Virtual size: 72B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 31KB - Virtual size: 30KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 5KB - Virtual size: 7KB

.gfids
Size: 512B - Virtual size: 72B

.reloc
Size: 4KB - Virtual size: 3KB