Neyasnoe[.]v1[.]18[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

Neyasnoe.v1.18.rar
Size

606.0MB
MD5

ec82c8ca910d251deafa909caafe2264
SHA1

0b5f3e80708830aa18eb34a25ce75c32f2dd7b65
SHA256

c1d8889720058b4fde1373c6ccd54a21cdc32f767f43daa99701433d043dccec
SHA512

429c2fdd8bb583619c14ad882d86cd26be1df6e4e7819228687fa6d62f1ba720ae8788d3850858e87d70c93c29146cd2004594684a42699bd2b5781b6ebf51f5
SSDEEP

12582912:AHINwB0o+Lgym/Et5O1TMbXwZQkLmc/8dF3VDdRFGmuweJd0x:Ax4CBIgZQA/4FlBqza

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Neyasnoe.v1.18/neyasnoe.exe

Files

Neyasnoe.v1.18.rar
.rar
Neyasnoe.v1.18/neyasnoe.exe
.exe windows:6 windows x64 arch:x64

5e6bacfbb04af5bbb7584ee45b1b436b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

winmm

midiInOpen
midiInStart
midiInClose
midiInGetErrorTextA
midiInGetNumDevs
midiInGetID
midiInStop
midiInGetDevCapsA
timeBeginPeriod
timeGetTime
timeEndPeriod

opengl32

wglGetProcAddress
wglDeleteContext
wglMakeCurrent
wglCreateContext

kernel32

GetLastError
GetCurrentThread
QueryPerformanceFrequency
CloseHandle
GetNativeSystemInfo
GetSystemInfo
LoadLibraryW
GetLocalTime
GetProcAddress
GlobalLock
GetCurrentProcessId
SystemTimeToFileTime
CreateProcessW
FreeLibrary
GetConsoleWindow
GetSystemTime
QueryPerformanceCounter
GlobalUnlock
LoadLibraryExW
GetExitCodeProcess
LoadLibraryA
GetSystemPowerStatus
SetConsoleTextAttribute
MultiByteToWideChar
FlushFileBuffers
GetFileSizeEx
GetTimeZoneInformation
ReadConsoleW
SetFilePointerEx
HeapReAlloc
CreatePipe
GetFileAttributesExW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCommandLineA
WriteFile
RemoveDirectoryW
MoveFileExW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileInformationByHandle
GetDriveTypeW
CreateFileW
FormatMessageW
FreeLibraryAndExitThread
ExitThread
CreateThread
ReadFile
GetFileType
SetStdHandle
DuplicateHandle
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
RaiseException
RtlPcToFileHeader
RtlUnwindEx
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
ResetEvent
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetStringTypeW
LCMapStringEx
DecodePointer
EncodePointer
GetModuleHandleW
GetConsoleMode
Sleep
LCIDToLocaleName
GetModuleHandleA
WaitForSingleObject
GetEnvironmentVariableW
SetThreadPriority
GetUserDefaultUILanguage
GetLocaleInfoEx
SetEnvironmentVariableW
GetModuleFileNameW
TerminateProcess
OutputDebugStringA
GetStdHandle
GetCurrentProcess
SetPriorityClass
GetSystemTimeAsFileTime
SetLastError
GetConsoleScreenBufferInfo
SetConsoleCtrlHandler
WideCharToMultiByte
LocalFree
GlobalAlloc
GetCommandLineW
GetConsoleOutputCP
GetFullPathNameW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleHandleExW
WriteConsoleW
SetEndOfFile
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
FindNextFileW
FindClose
CreateSemaphoreA
CreateEventA
VirtualFree
CreateMutexA
ReleaseMutex
HeapFree
GetTickCount64
HeapAlloc
GetProcessHeap
ReleaseSemaphore
SetEvent
TryEnterCriticalSection
ReplaceFileW
CreateDirectoryW
GetVolumeInformationW
GetLogicalDrives
FindFirstFileExW
GetFileAttributesW
DeleteFileW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetTempFileNameW
GetDiskFreeSpaceExA
ExitProcess
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
GetCurrentThreadId
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
WaitForSingleObjectEx
GetExitCodeThread
HeapSize

ole32

CoInitialize
CoCreateInstance
PropVariantClear
CoTaskMemFree

user32

GetDC
GetRawInputDeviceInfoA
GetRawInputDeviceList
DefWindowProcW
AdjustWindowRectEx
GetKeyState
GetMessageExtraInfo
AllowSetForegroundWindow
CallWindowProcW
CloseTouchInputHandle
GetTouchInputInfo
GetWindowRect
LoadCursorA
IsWindowVisible
SetWindowPos
MessageBoxW
MonitorFromWindow
SetWindowRgn
EnumDisplayMonitors
CreateWindowExW
GetKeyboardLayoutNameA
ScreenToClient
GetSystemMetrics
SetWindowTextW
RegisterClassExW
ShowWindow
OpenClipboard
DispatchMessageW
SetTimer
DestroyIcon
RegisterTouchWindow
CreateIconIndirect
ClientToScreen
CloseClipboard
EmptyClipboard
PeekMessageW
GetKeyboardLayoutList
GetRawInputData
TrackMouseEvent
GetKeyboardLayout
CreateIconFromResource
MessageBoxA
MoveWindow
SetFocus
RegisterRawInputDevices
TranslateMessage
GetClipboardData
ClipCursor
SendMessageA
SetCapture
SetClipboardData
SetCursor
LoadIconA
FlashWindowEx
SystemParametersInfoA
GetClientRect
IsClipboardFormatAvailable
GetWindowLongPtrA
ActivateKeyboardLayout
KillTimer
SetWindowLongPtrA
ReleaseCapture
SetForegroundWindow
IsIconic
SetCursorPos
ReleaseDC
GetCursorPos

gdi32

GetObjectA
ChoosePixelFormat
SetPixelFormat
SwapBuffers
DeleteObject
CreateBitmap
SetTextColor
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
CreatePolygonRgn
GetDeviceCaps
CreateRectRgn
DeleteDC
SetBkColor

shell32

DragQueryFileW
CommandLineToArgvW
ShellExecuteW
SHGetKnownFolderPath
SHFileOperationW
DragAcceptFiles

advapi32

GetCurrentHwProfileA
RegOpenKeyExW
RegCloseKey
RegQueryValueExW

dinput8

DirectInput8Create

imm32

ImmReleaseContext
ImmGetContext
ImmAssociateContext
ImmSetCompositionWindow

avrt

AvSetMmThreadCharacteristicsA
AvSetMmThreadPriority

dwmapi

DwmIsCompositionEnabled
DwmEnableBlurBehindWindow
DwmFlush

iphlpapi

GetBestInterfaceEx
GetAdaptersAddresses

shlwapi

PathFileExistsW

wsock32

WSACleanup
__WSAFDIsSet
listen
htons
ntohs
closesocket
send
getsockname
htonl
ntohl
WSAGetLastError
setsockopt
connect
socket
sendto
ioctlsocket
bind
recv
select
inet_ntoa
recvfrom
WSAStartup
accept

ws2_32

freeaddrinfo
getnameinfo
inet_pton
WSAConnect
getaddrinfo

bcrypt

BCryptGenRandom

steam_api64

SteamAPI_UnregisterCallback
SteamGameServer_Shutdown
SteamInternal_ContextInit
SteamAPI_Shutdown
SteamInternal_FindOrCreateGameServerInterface
SteamAPI_GetHSteamUser
SteamAPI_ReleaseCurrentThreadMemory
SteamAPI_IsSteamRunning
SteamInternal_GameServer_Init
SteamAPI_RegisterCallResult
SteamAPI_RegisterCallback
SteamGameServer_GetHSteamUser
SteamAPI_RestartAppIfNecessary
SteamAPI_Init
SteamAPI_UnregisterCallResult
SteamInternal_FindOrCreateUserInterface
SteamAPI_RunCallbacks

Exports

Exports

?_main@@YAHXZ
?widechar_main@@YAHHPEAPEA_W@Z
AmdPowerXpressRequestHighPerformance
NvOptimusEnablement
main

Sections

.text
Size: 26.8MB - Virtual size: 26.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6.6MB - Virtual size: 6.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 490KB - Virtual size: 563KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 858KB - Virtual size: 857KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 165KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Neyasnoe.v1.18/neyasnoe.pck

Sharing

General

Malware Config

Signatures

Files

5e6bacfbb04af5bbb7584ee45b1b436b

Headers

DLL Characteristics

File Characteristics

Imports

winmm

opengl32

kernel32

ole32

user32

gdi32

shell32

advapi32

dinput8

imm32

avrt

dwmapi

iphlpapi

shlwapi

wsock32

ws2_32

bcrypt

steam_api64

Exports

Exports

Sections

.text Size: 26.8MB - Virtual size: 26.8MB

.rdata Size: 6.6MB - Virtual size: 6.6MB

.data Size: 490KB - Virtual size: 563KB

.pdata Size: 858KB - Virtual size: 857KB

_RDATA Size: 512B - Virtual size: 252B

.rsrc Size: 106KB - Virtual size: 106KB

.reloc Size: 165KB - Virtual size: 164KB

.text
Size: 26.8MB - Virtual size: 26.8MB

.rdata
Size: 6.6MB - Virtual size: 6.6MB

.data
Size: 490KB - Virtual size: 563KB

.pdata
Size: 858KB - Virtual size: 857KB

_RDATA
Size: 512B - Virtual size: 252B

.rsrc
Size: 106KB - Virtual size: 106KB

.reloc
Size: 165KB - Virtual size: 164KB