679b3530958a59e33e4bfec121d91680_NEAS

Sharing

Copy URL Twitter E-mail

General

Target

679b3530958a59e33e4bfec121d91680_NEAS
Size

207KB
MD5

679b3530958a59e33e4bfec121d91680
SHA1

06dac3ed32808bb2585444b522d4567e92293c79
SHA256

536803f35ee9a57c319773f0ef45a3376dd4511eb6ccc1612aabe89178efd90e
SHA512

d2449529d840834404b0ed18e4594b770197e313b54123663eba022151d578153ace911a0cc14dd7ef41492ff98ae99bf8f252fb740f174a62793d77b132d833
SSDEEP

3072:DrpHdZlwNPfoOPDfBq05N9aWrYp3xTmhSkPlbzNK8Hl3wx+J4yf:DrpHd0RoOPDfjfp8txqVxAxg4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
679b3530958a59e33e4bfec121d91680_NEAS

Files

679b3530958a59e33e4bfec121d91680_NEAS
.dll windows:5 windows x86 arch:x86

1a6c0c8da2bbcf3c40eca31012170aea

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\GeekBuddy_DEV\trunk\4.0\setup\win\setupgeekbuddy\NSIS\Plugins\GeekBuddyNsisPlugin.pdb

Imports

kernel32

GetCurrentProcess
OpenProcess
LoadLibraryW
TerminateProcess
GetProcAddress
GetNativeSystemInfo
InterlockedDecrement
WaitForSingleObject
GetFileAttributesW
DeleteFileW
lstrlenW
LocalFree
lstrlenA
SetEnvironmentVariableA
FlushFileBuffers
WriteConsoleW
SetStdHandle
GetStringTypeW
SetFilePointerEx
RemoveDirectoryW
Sleep
GetLastError
CreateDirectoryW
GetCurrentProcessId
CloseHandle
GetLocalTime
CreateFileW
WriteFile
GetSystemDirectoryA
OutputDebugStringW
GetConsoleMode
GetConsoleCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
HeapReAlloc
LoadLibraryExW
RtlUnwind
LeaveCriticalSection
GlobalFree
lstrcpyW
lstrcpynW
GlobalAlloc
WideCharToMultiByte
MultiByteToWideChar
EncodePointer
DecodePointer
HeapFree
HeapAlloc
IsDebuggerPresent
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetCommandLineA
GetCurrentThreadId
RaiseException
ExitProcess
GetModuleHandleExW
HeapSize
GetProcessHeap
SetLastError
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStdHandle
GetModuleFileNameW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetTimeZoneInformation
GetFileType
DeleteCriticalSection
GetModuleFileNameA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
EnterCriticalSection

psapi

EnumProcesses
GetModuleFileNameExW

netapi32

NetApiBufferFree
NetWkstaGetInfo

user32

wsprintfW

advapi32

RegCreateKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegDeleteKeyW
RegQueryValueExW
RegSetValueExW

shell32

SHGetSpecialFolderPathW
SHFileOperationW
ShellExecuteExW

ole32

CoInitializeSecurity
CoCreateInstance
CoInitializeEx
CoUninitialize
CoSetProxyBlanket

oleaut32

VariantClear
VariantChangeType
SysAllocString
SysFreeString
SysStringLen
VariantInit

Exports

Exports

CreateSecondFlag
DisableSafeBoot
FolderCleanUp
LogInstall
LogLine
LogUninstall
SetLicenseId
SetLocaleId
SetOSInstanceID
SilentExecute
StopUnits
UninstallLPS
UninstallPlugins
WriteTimestampKey

Sections

.text
Size: 142KB - Virtual size: 141KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1a6c0c8da2bbcf3c40eca31012170aea

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

psapi

netapi32

user32

advapi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 142KB - Virtual size: 141KB

.rdata Size: 48KB - Virtual size: 47KB

.data Size: 7KB - Virtual size: 14KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 142KB - Virtual size: 141KB

.rdata
Size: 48KB - Virtual size: 47KB

.data
Size: 7KB - Virtual size: 14KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 8KB - Virtual size: 8KB