7162964d29739865084f9e6fca854fa0_NEAS

Sharing

Copy URL Twitter E-mail

General

Target

7162964d29739865084f9e6fca854fa0_NEAS
Size

1.1MB
MD5

7162964d29739865084f9e6fca854fa0
SHA1

405cbbe26c3911445e0f3e8fd06d7fbdbd813a14
SHA256

16afc1a6bc23f33b9e099df663db2dbbc3ce3a47fa9c008e4abcae46d9564848
SHA512

6d4f01485a3173f37c6f8f36ab1d635a0b73bdc28de65982cbfb1db1be1e94a8b8cb3cf82efd7fa4566cb25d166ffa2f084faa95e4e133b553e69adabcd0df86
SSDEEP

24576:lIPK4rVPd7fHtJWRpJKWRGWfnKtN+hS5UnEjBJrwH:IK4rVFDNJW/fRGKUNSSAqjS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7162964d29739865084f9e6fca854fa0_NEAS

Files

7162964d29739865084f9e6fca854fa0_NEAS
.dll windows:6 windows x86 arch:x86

a60fb29e2952844db77c09e57631927d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\ewgm\Desktop\FAST S17 X5000 PART 1-3\muPlugin.pdb

Imports

kernel32

GetProcAddress
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForMultipleObjects
GetCurrentThreadId
CreateFileW
GetFileInformationByHandle
SetFilePointer
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
CreateDirectoryA
GetLocalTime
GetFullPathNameA
WaitForSingleObject
CreateMutexA
GetCurrentProcessId
CreateRemoteThread
VirtualQuery
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
OpenMutexA
HeapAlloc
HeapFree
GetProcessHeap
GetModuleFileNameA
LoadLibraryA
GetLastError
DeviceIoControl
GetCurrentProcess
GetTickCount
GetVersionExA
TryEnterCriticalSection
VirtualProtect
GetLogicalDriveStringsW
QueryDosDeviceW
SetEvent
CreateEventA
Sleep
TerminateProcess
GetLogicalDriveStringsA
QueryDosDeviceA
InterlockedCompareExchange
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualFree
SetLastError
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
OpenProcess
GetCurrentThread
WriteFile
ReadFile
GetFileSize
FindNextFileA
FindFirstFileA
DeleteFileA
GetModuleHandleA
CreateFileA
OpenFileMappingA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
TerminateThread
GetPrivateProfileIntA
CreateThread
CloseHandle
GlobalMemoryStatusEx
InitializeSListHead

user32

DefWindowProcA
SendMessageA
MessageBoxA
LoadImageA
SetWindowLongA
GetSystemMetrics
CallWindowProcA
UnhookWindowsHookEx
DispatchMessageA
ShowWindow
UpdateWindow
UnregisterClassA
EndPaint
GetCursorPos
ScreenToClient
wsprintfA
wsprintfW
GetKeyState
GetForegroundWindow
GetWindowRect
SetWindowsHookExA
CallNextHookEx
GetMessageA
LoadCursorA
PostQuitMessage
RegisterClassExA
BeginPaint
CreateWindowExA
GetClientRect
GetWindowLongA
GetWindowThreadProcessId
FindWindowExA
TranslateMessage

gdi32

SetTextColor
TextOutA
SetBkMode
SelectObject
GetStockObject
DeleteObject
CreateFontA
CreateCompatibleDC
GetObjectA
DeleteDC
BitBlt

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegOpenKeyA

msvcp140

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z

ws2_32

closesocket
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAWaitForMultipleEvents
getpeername
ntohs
WSACloseEvent
connect
htons
inet_addr
recv
send
socket
gethostbyname
WSAStartup
WSAGetLastError

psapi

GetModuleInformation
GetProcessImageFileNameW
GetModuleFileNameExA
EnumProcessModules
EnumProcesses

shlwapi

SHDeleteKeyA
PathRemoveFileSpecW

dbghelp

ImageRvaToSection

vcruntime140

__current_exception_context
__current_exception
_except_handler4_common
memchr
wcsstr
__std_type_info_destroy_list
__CxxFrameHandler3
_CxxThrowException
memcpy
memmove
memset
__std_exception_destroy
memcmp
__std_exception_copy

api-ms-win-crt-heap-l1-1-0

malloc
free
_callnewh

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s
_wfopen_s
fclose
fread
fopen_s

api-ms-win-crt-string-l1-1-0

strcmp
wcslen
strlen
_stricmp
wcscpy_s
strcpy_s

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initialize_narrow_environment
terminate
_initterm
_initterm_e

api-ms-win-crt-math-l1-1-0

floor

Exports

Exports

EntryProc

Sections

.text
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1002KB - Virtual size: 1001KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a60fb29e2952844db77c09e57631927d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

msvcp140

ws2_32

psapi

shlwapi

dbghelp

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 95KB - Virtual size: 95KB

.rdata Size: 33KB - Virtual size: 32KB

.data Size: 1024B - Virtual size: 61KB

.rsrc Size: 1002KB - Virtual size: 1001KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 95KB - Virtual size: 95KB

.rdata
Size: 33KB - Virtual size: 32KB

.data
Size: 1024B - Virtual size: 61KB

.rsrc
Size: 1002KB - Virtual size: 1001KB

.reloc
Size: 6KB - Virtual size: 6KB