2e0ab2413926f686916192b404c65140_NEAS

Sharing

Copy URL Twitter E-mail

General

Target

2e0ab2413926f686916192b404c65140_NEAS
Size

2.1MB
MD5

2e0ab2413926f686916192b404c65140
SHA1

cfab868a6289590599e2ff67e1ba0cbb94bd5355
SHA256

649618eae441d89efa6ce271fdd54834ce1d61c0525fa1a6c93dfa157b4e1b51
SHA512

cb53c8b4393680c5279e81c6666e05779105c6ecb282952aa1ca4d2e611dc80e9df88531fb8c6bc4f3e1e63c436b51a6ee6b57a44d0ee6bb1791d9a2a71175e0
SSDEEP

49152:Vc99rust0yuIgV1plIxw1eEJ1qpDfp9r2mrbhWdqT/:GruHIuI6Vs9r3Qq/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2e0ab2413926f686916192b404c65140_NEAS

Files

2e0ab2413926f686916192b404c65140_NEAS
.exe windows:5 windows x86 arch:x86

d1cb338c9d2a7a217b3d58993774729c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

icuuc46

??2UMemory@icu_46@@SAPAXI@Z
??3UMemory@icu_46@@SAXPAX@Z

iculx46

??1FontRuns@icu_46@@UAE@XZ
?getDynamicClassID@ParagraphLayout@icu_46@@UBEPAXXZ
?getParagraphLevel@ParagraphLayout@icu_46@@QAEEXZ
?getLeading@ParagraphLayout@icu_46@@UBEHXZ
?getDescent@ParagraphLayout@icu_46@@UBEHXZ
?getAscent@ParagraphLayout@icu_46@@UBEHXZ
?getVisualRun@Line@ParagraphLayout@icu_46@@QBEPBVVisualRun@23@H@Z
?nextLine@ParagraphLayout@icu_46@@QAEPAVLine@12@M@Z
??0ParagraphLayout@icu_46@@QAE@QB_WHPBVFontRuns@1@PBVValueRuns@1@2PBVLocaleRuns@1@ECAAW4LEErrorCode@@@Z
?add@FontRuns@icu_46@@QAEHPBVLEFontInstance@2@H@Z
??0FontRuns@icu_46@@QAE@H@Z
??1ParagraphLayout@icu_46@@UAE@XZ

fmodex

?release@Sound@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?stop@Channel@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?setVolume@Channel@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?playSound@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_CHANNELINDEX@@PAVSound@2@_NPAPAVChannel@2@@Z
?isPlaying@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z
?setMode@Sound@FMOD@@QAG?AW4FMOD_RESULT@@I@Z
?createSound@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDIPAUFMOD_CREATESOUNDEXINFO@@PAPAVSound@2@@Z
?release@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?close@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?init@System@FMOD@@QAG?AW4FMOD_RESULT@@HIPAX@Z
?getVersion@System@FMOD@@QAG?AW4FMOD_RESULT@@PAI@Z
FMOD_System_Create

comctl32

ImageList_Create
InitCommonControlsEx
_TrackMouseEvent
ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Remove
ord17

rpcrt4

RpcStringFreeW
UuidCreate
UuidToStringW

kernel32

GetStartupInfoW
CreateProcessW
WaitForSingleObject
GetTickCount
WideCharToMultiByte
MultiByteToWideChar
CreateFileW
WriteFile
LocalAlloc
CreateDirectoryW
GetLastError
LocalFree
FindFirstFileW
FindNextFileW
FindClose
GetFileSize
GetLocaleInfoW
GetDateFormatW
GetTimeFormatW
GetTimeZoneInformation
SystemTimeToFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrcatW
GetFileAttributesW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetFileType
GetFileInformationByHandle
GetSystemTime
GetLocalTime
SetFilePointer
ReadFile
FileTimeToDosDateTime
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
DosDateTimeToFileTime
SetFileTime
IsWow64Process
FormatMessageW
GetStdHandle
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
QueryPerformanceFrequency
LoadLibraryExW
RaiseException
RtlUnwind
AreFileApisANSI
MoveFileExW
CopyFileW
CreateDirectoryExW
DeviceIoControl
SetFilePointerEx
SetEndOfFile
RemoveDirectoryW
GetFileTime
GetFileAttributesExW
DeleteFileW
InitializeSListHead
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventW
InitializeCriticalSectionAndSpinCount
SetLastError
DecodePointer
EncodePointer
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetStringTypeW
GlobalReAlloc
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcpynW
lstrlenW
_lread
GetProcAddress
VerifyVersionInfoW
VerSetConditionMask
MulDiv
Sleep
Beep
CloseHandle
CreateThread
GetCurrentProcess
TerminateProcess
FreeLibrary
GetModuleHandleW
LoadLibraryW
GetACP
GetModuleFileNameW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapAlloc
HeapFree
GetConsoleMode
ReadConsoleW
GetConsoleCP
FlushFileBuffers
HeapReAlloc
FindFirstFileExA
FindNextFileA
IsValidCodePage
ResetEvent
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
WaitForSingleObjectEx
SetStdHandle
WriteConsoleW
HeapSize
lstrcpyW
GetSystemDirectoryW
SetEvent
FormatMessageA

user32

CreateIconIndirect
GetIconInfo
SetRect
SetScrollInfo
GetScrollInfo
GetScrollPos
TrackPopupMenuEx
InsertMenuW
GetMenuState
GetSubMenu
GetMenuItemRect
GetMenuItemInfoW
GetMenuItemCount
EnableMenuItem
ModifyMenuW
SetScrollPos
GetComboBoxInfo
GetWindowTextLengthW
TranslateAcceleratorW
DestroyAcceleratorTable
CreateAcceleratorTableW
GetNextDlgGroupItem
GetNextDlgTabItem
GetClassNameW
ActivateKeyboardLayout
SetWindowTextW
IsWindowVisible
EndPaint
BeginPaint
GetCursor
SetClassLongW
GetClassLongW
MapWindowPoints
MoveWindow
DestroyWindow
DefWindowProcW
DrawIconEx
LoadImageW
ShowScrollBar
IntersectRect
UnionRect
RedrawWindow
SetWindowRgn
EqualRect
OffsetRect
ReleaseCapture
SetCapture
IsWindowEnabled
GetKeyboardLayout
DialogBoxParamW
CreateWindowExW
RegisterClassExW
GetMessageW
SendInput
VkKeyScanW
GetKeyboardState
ToUnicodeEx
MapVirtualKeyExW
GetWindowTextW
GetParent
TranslateMessage
DispatchMessageW
PostMessageW
MessageBoxW
GetDlgItem
EnableWindow
GetClientRect
InvalidateRect
SendMessageW
GetFocus
GetMessagePos
GetKeyState
SystemParametersInfoW
GetWindowLongW
GetCapture
DestroyMenu
CreateMenu
SetMenuDefaultItem
GetWindowRect
GetSysColor
SetForegroundWindow
GetDC
ReleaseDC
CharNextW
SetWindowPos
FillRect
GetSysColorBrush
GetCursorPos
CreatePopupMenu
InsertMenuItemW
TrackPopupMenu
LoadIconW
ClientToScreen
ScreenToClient
PtInRect
DestroyIcon
InflateRect
GetAsyncKeyState
CallWindowProcW
SetWindowLongW
LoadCursorW
SetFocus
SetCursor
KillTimer
SetTimer
PostQuitMessage
ShowWindow
FindWindowW
UnloadKeyboardLayout
GetKeyboardLayoutNameW
LoadKeyboardLayoutW
EndDialog
GetKeyboardLayoutList

gdi32

CreateSolidBrush
CreateCompatibleBitmap
BitBlt
ExtCreateRegion
SetLayout
RestoreDC
CreateBitmap
GetPixel
StretchBlt
SetStretchBltMode
SaveDC
CreateDIBSection
DeleteDC
CombineRgn
GetTextExtentPoint32W
CreateCompatibleDC
SetPixel
AddFontResourceExW
RemoveFontResourceExW
TextOutW
CreateRectRgnIndirect
OffsetRgn
CreateRectRgn
SetBkColor
SetTextColor
GetDeviceCaps
GetObjectA
GetGlyphOutlineW
GetTextMetricsW
GetKerningPairsW
SelectObject
SetViewportOrgEx
SetWindowOrgEx
SetGraphicsMode
ModifyWorldTransform
GetOutlineTextMetricsW
GetFontData
CreateFontIndirectW
GetObjectW
SelectClipRgn
DeleteObject

comdlg32

GetSaveFileNameW
GetOpenFileNameW
ChooseColorW

advapi32

RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
AccessCheck
MapGenericMask
DuplicateToken
OpenProcessToken
GetFileSecurityW
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
GetUserNameW

shell32

ShellExecuteExW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetMalloc
Shell_NotifyIconW
SHGetSpecialFolderPathW

gdiplus

GdipScaleWorldTransform
GdipSetPenDashStyle
GdipCreateLineBrush
GdipSetClipRect
ord1
GdipDrawPath
GdipDrawEllipse
GdipDrawLineI
GdipSetPenStartCap
GdipDrawRectangleI
GdipResetWorldTransform
GdipGetImageHeight
GdipGetImageWidth
GdipImageRotateFlip
GdipDrawImagePointsRectI
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateBitmapFromHBITMAP
GdipSaveImageToFile
GdipDrawImageI
GdipSetLinePresetBlend
GdipFillRectangleI
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromFileICM
GdipDrawImagePointRectI
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromGraphics
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipMeasureString
GdipSetSmoothingMode
GdipGetSolidFillColor
GdipSetWorldTransform
GdipScaleMatrix
GdipRotateMatrix
GdipTranslateMatrix
GdipDeleteMatrix
GdipCreateMatrix
GdipGraphicsClear
GdipCreateLineBrushFromRect
GdipFillRectangle
GdipDrawLines
GdipFillPolygon
GdipDrawLine
GdipTranslateWorldTransform
GdipCreatePen1
GdipCreateSolidFill
GdipSetTextRenderingHint
GdipDeletePen
GdipCloneBrush
GdipDeleteBrush
GdipFillPath
GdipDeleteFont
GdipDeletePrivateFontCollection
GdipMeasureDriverString
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDrawString
GdipDrawDriverString
GdipGetFontStyle
GdipCreateFontFamilyFromName
GdipGetGenericFontFamilySansSerif
GdipCreateFont
GdipGetFamilyName
GdipGetFontCollectionFamilyList
GdipCloneFontFamily
GdipPrivateAddFontFile
GdipNewPrivateFontCollection
GdipFree
GdipAlloc
GdipDeleteFontFamily
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipClosePathFigure
GdipAddPathBezier
GdipAddPathLine
GdipDeletePath
GdipCreatePath
GdipSetPathFillMode
GdipDeleteGraphics
GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup
GdipDrawRectangle
GdipFillEllipse

icule46

??0LEFontInstance@icu_46@@QAE@XZ
?getLineHeight@LEFontInstance@icu_46@@UBEHXZ
?transformFunits@LEFontInstance@icu_46@@UBEXMMAAULEPoint@@@Z
?pixelsToUnits@LEFontInstance@icu_46@@UBEXAAULEPoint@@0@Z
?yPixelsToUnits@LEFontInstance@icu_46@@UBEMM@Z
?xPixelsToUnits@LEFontInstance@icu_46@@UBEMM@Z
?unitsToPoints@LEFontInstance@icu_46@@UBEXAAULEPoint@@0@Z
?yUnitsToPoints@LEFontInstance@icu_46@@UBEMM@Z
?xUnitsToPoints@LEFontInstance@icu_46@@UBEMM@Z
?mapCharToGlyph@LEFontInstance@icu_46@@UBEIHPBVLECharMapper@2@C@Z
?mapCharToGlyph@LEFontInstance@icu_46@@UBEIHPBVLECharMapper@2@@Z
?mapCharsToGlyphs@LEFontInstance@icu_46@@UBEXQB_WHHCPBVLECharMapper@2@CAAVLEGlyphStorage@2@@Z
?canDisplay@LEFontInstance@icu_46@@UBECH@Z
?getSubFont@LEFontInstance@icu_46@@UBEPBV12@QB_WPAHHHAAW4LEErrorCode@@@Z
?getDynamicClassID@LEFontInstance@icu_46@@UBEPAXXZ
??1LEFontInstance@icu_46@@UAE@XZ

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 320KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 162KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d1cb338c9d2a7a217b3d58993774729c

Headers

DLL Characteristics

File Characteristics

Imports

icuuc46

iculx46

fmodex

comctl32

rpcrt4

kernel32

user32

gdi32

comdlg32

advapi32

shell32

gdiplus

icule46

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 320KB - Virtual size: 320KB

.data Size: 23KB - Virtual size: 31KB

.rsrc Size: 162KB - Virtual size: 161KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 320KB - Virtual size: 320KB

.data
Size: 23KB - Virtual size: 31KB

.rsrc
Size: 162KB - Virtual size: 161KB