NEAS[.]b9b7d223adf144ffc0bdec553612cb20[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.b9b7d223adf144ffc0bdec553612cb20.exe
Size

1.2MB
MD5

b9b7d223adf144ffc0bdec553612cb20
SHA1

c70e98e8f5461c1091c6eb1dde6aba7037a177f6
SHA256

7df04fd68cee77a27c4de6a59c3a20220c7123bfaac781d9ad92ea2472ff1a09
SHA512

7704fde0c94330d5a7d267b00107409d3c431ffa16505976c50e65690d2ae4e298aa5807878769def90fcee68473dbfadbcdc9048e73e6a1cae0b642bc78dd98
SSDEEP

24576:o3ZkFZoAmzKCFY2zksCK4Y1AnvItbgwwKMvGe7s8Eq0gnCAs:owoAQKGpcIB4GjBb2Ts

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.b9b7d223adf144ffc0bdec553612cb20.exe

Files

NEAS.b9b7d223adf144ffc0bdec553612cb20.exe
.exe windows:5 windows x86 arch:x86

fbde654a685ad2acda76ddba4bf7826f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemInfo
OutputDebugStringA
GetCurrentThread
GetCurrentThreadId
GetCommandLineA
CreateToolhelp32Snapshot
Process32FirstW
GetCurrentProcessId
Process32NextW
OpenProcess
CloseHandle
GetModuleFileNameW
WaitForSingleObject
GetSystemDirectoryA
CreateMutexA
GlobalAlloc
GlobalFree
SetEnvironmentVariableA
CompareStringW
WriteConsoleW
GetProcessHeap
SetStdHandle
GetConsoleMode
GetConsoleCP
GetCurrentDirectoryW
PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameA
LCMapStringW
GetStringTypeW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
MultiByteToWideChar
WideCharToMultiByte
FoldStringW
TerminateThread
SetThreadAffinityMask
GetProcessAffinityMask
GetCurrentProcess
SetPriorityClass
GetProcAddress
GetModuleHandleW
SetThreadPriority
GetPriorityClass
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
CreateSemaphoreW
CreateEventW
CreateMutexW
ReleaseMutex
ResetEvent
ReleaseSemaphore
SetEvent
WaitForMultipleObjects
CreateEventA
PulseEvent
Sleep
TlsGetValue
Thread32Next
Thread32First
InitializeCriticalSection
TlsSetValue
TlsFree
TlsAlloc
RaiseException
ResumeThread
CreateThread
InterlockedExchangeAdd
GetTickCount
InterlockedCompareExchange
GetVolumeInformationW
DeviceIoControl
CreateFileW
GetFileAttributesW
GetDriveTypeW
GetLogicalDriveStringsW
LocalFree
FormatMessageW
FindClose
FindNextFileW
GetLastError
GetDiskFreeSpaceW
DeleteFileW
MoveFileW
CreateDirectoryW
RemoveDirectoryW
SetCurrentDirectoryW
GetFileSize
SetFileAttributesW
FindFirstFileW
SetErrorMode
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileTime
SetUnhandledExceptionFilter
FormatMessageA
GetModuleHandleA
GetModuleFileNameA
VirtualQuery
WriteFile
LoadLibraryA
IsBadWritePtr
GetLocalTime
SetFilePointer
CreateFileA
GetTimeFormatW
GetDateFormatW
FreeLibrary
LoadLibraryW
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
CreateProcessW
TerminateProcess
FlushFileBuffers
SetEndOfFile
ReadFile
GetLocaleInfoW
GetSystemDefaultLangID
GetUserDefaultUILanguage
SizeofResource
FindResourceW
LockResource
LoadResource
GetVersionExA
GetComputerNameW
GetVersionExW
QueryPerformanceFrequency
QueryPerformanceCounter
DecodePointer
EncodePointer
RtlUnwind
HeapAlloc
HeapFree
HeapSetInformation
GetStartupInfoW
HeapReAlloc
GetDriveTypeA
FindFirstFileExA
CreateDirectoryA
GetTimeZoneInformation
GetSystemTimeAsFileTime
GetStdHandle
InterlockedIncrement
SetLastError
InterlockedDecrement
UnhandledExceptionFilter
IsDebuggerPresent
HeapSize
ExitProcess
IsProcessorFeaturePresent
HeapCreate
GetFileAttributesA

user32

TranslateMessage
PeekMessageW
DispatchMessageW
wsprintfA
EnumDisplaySettingsW
GetDC
ReleaseDC
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetSystemMetrics
LoadCursorW
EnumWindows
GetWindowThreadProcessId
CharLowerW
CharUpperW
CharLowerA
CharUpperA
KillTimer
SetTimer
DefWindowProcW
DestroyWindow
CreateWindowExW
RegisterClassExW
wvsprintfA
MessageBoxW
ShowWindow

shell32

SHGetSpecialFolderPathW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderPathA

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

ws2_32

recv
send
ntohs
getsockname
getpeername
closesocket
shutdown
socket
gethostname
htons
htonl
sendto
select
setsockopt
inet_ntoa
gethostbyaddr
WSACleanup
WSAStartup
__WSAFDIsSet
ioctlsocket
getsockopt
inet_addr
freeaddrinfo
connect
getaddrinfo
bind
listen
accept
getnameinfo
recvfrom
gethostbyname

shlwapi

StrRChrW
PathStripToRootW
StrChrW
StrCmpW
StrCmpIW

imagehlp

ImageLoad
ImageUnload

winmm

timeGetTime

gdi32

GetDCOrgEx
GetClipBox
GetDeviceCaps

advapi32

RegQueryValueExA
GetUserNameW
RegOpenKeyExA
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegEnumValueW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegEnumKeyW
RegDeleteKeyW

ole32

CoCreateInstance
CoCreateGuid
CoUninitialize
CoInitialize

oleaut32

VarDateFromStr
VariantTimeToSystemTime

Sections

.text
Size: 1006KB - Virtual size: 1006KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 238KB - Virtual size: 238KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fbde654a685ad2acda76ddba4bf7826f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

version

ws2_32

shlwapi

imagehlp

winmm

gdi32

advapi32

ole32

oleaut32

Sections

.text Size: 1006KB - Virtual size: 1006KB

.rdata Size: 238KB - Virtual size: 238KB

.data Size: 18KB - Virtual size: 42KB

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 1006KB - Virtual size: 1006KB

.rdata
Size: 238KB - Virtual size: 238KB

.data
Size: 18KB - Virtual size: 42KB

.rsrc
Size: 1KB - Virtual size: 1KB