8fcebc09798cb973dbaf550746836a40_NEAS

Sharing

Copy URL Twitter E-mail

General

Target

8fcebc09798cb973dbaf550746836a40_NEAS
Size

1.7MB
MD5

8fcebc09798cb973dbaf550746836a40
SHA1

23d2d359ab1150af9e99bc6d307a1f180c1faaa8
SHA256

09ed761c9b1597c6d336d5910d2493627516db30710f9180dfcb54fa531041ab
SHA512

f38540a3fc58f6771064e3888fcbaf41e9062e33d831b3b78e8d457ccb8c28e57bde60817123da96e6f0534ee8fdf79435381278a72f294040bbdd798fc3d60f
SSDEEP

24576:MbQ8EM07+55O/V49pFT0SLTQYWkK2u4dax8C:M8y07n/s7YSLTQYWkK2/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8fcebc09798cb973dbaf550746836a40_NEAS

Files

8fcebc09798cb973dbaf550746836a40_NEAS
.exe windows:10 windows x64 arch:x64

888742b8dd20542042b35143c687bdb7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

vssagent.pdb

Imports

advapi32

OpenEventLogW
ReadEventLogW
CloseEventLog
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
OpenSCManagerW
OpenServiceW
QueryServiceStatus
ControlService
CloseServiceHandle
ConvertSidToStringSidW
OpenThreadToken
GetTokenInformation
DeregisterEventSource
RegDeleteTreeW
RegQueryValueExW
ReportEventW
RegisterEventSourceW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
TraceEvent
OpenProcessToken

kernel32

GetSystemInfo
GlobalMemoryStatusEx
QueryDosDeviceW
CloseHandle
CreateFileW
GetVolumeNameForVolumeMountPointW
FindFirstVolumeW
FindNextVolumeW
GetDriveTypeW
GetVolumePathNameW
GetDiskFreeSpaceExW
GetVolumeInformationW
FindVolumeClose
CopyFileW
GetFullPathNameW
ExpandEnvironmentStringsW
FindFirstFileW
FindNextFileW
GetSystemTimeAsFileTime
WideCharToMultiByte
WriteFile
LoadLibraryExW
FindClose
LeaveCriticalSection
EnterCriticalSection
GetVersionExW
SetConsoleCtrlHandler
GetModuleHandleW
InitializeCriticalSection
SetFilePointer
ReadFile
DeleteCriticalSection
CreateMutexW
ReleaseMutex
GetStdHandle
GetConsoleMode
SetConsoleMode
FreeLibrary
GetProcAddress
lstrcmpiW
lstrcpynW
VirtualProtect
VirtualAlloc
GetCurrentProcess
SizeofResource
LoadResource
FindResourceExW
lstrcpyW
Sleep
HeapDestroy
ReleaseSRWLockShared
InitializeSRWLock
GetCurrentThread
GetSystemTime
TlsFree
TlsGetValue
TlsAlloc
OutputDebugStringW
TlsSetValue
lstrlenW
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
OutputDebugStringA
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetComputerNameExW
GetWindowsDirectoryW
GetModuleFileNameW
DeleteFileW
AcquireSRWLockShared
MultiByteToWideChar
LocalAlloc
GetTimeFormatW
GetThreadLocale
GetDateFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
LocalFree
GetLastError
DeviceIoControl
GetNativeSystemInfo
VirtualQuery
IsWow64Process
FormatMessageW
GetCommandLineW
HeapSetInformation
GetTickCount

msvcrt

_unlock
memcpy
__dllonexit
_onexit
_lock
memcmp
_vsnprintf
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_commode
_fmode
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
_wtoi
wcscpy_s
wcscat_s
malloc
__C_specific_handler
fflush
??0exception@@QEAA@XZ
memmove_s
??0exception@@QEAA@AEBQEBD@Z
memcpy_s
iswalnum
qsort
free
realloc
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
_purecall
wcsncmp
_wcsicmp
wcschr
iswspace
_vsnwprintf
wprintf
__CxxFrameHandler3
memset
_CxxThrowException
__iob_func
_wcsnicmp
wcscmp

ole32

CoResumeClassObjects
CoRegisterClassObject
CoTaskMemRealloc
StringFromGUID2
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CLSIDFromString
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoRevokeClassObject

user32

CharNextW
KillTimer
SetTimer
UnregisterDeviceNotification
RegisterDeviceNotificationW
PostMessageW
FindWindowW
DestroyWindow
DispatchMessageW
TranslateMessage
GetMessageW
CreateWindowExW
RegisterClassW
DefWindowProcW
UnregisterClassW
LoadStringW
CharPrevW

oleaut32

VariantClear
VarUI4FromStr
GetErrorInfo
VariantChangeType
SysAllocString
SysStringLen
SysFreeString
RegisterTypeLi
LoadTypeLi

rpcrt4

RpcStringFreeW
UuidToStringW

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

shlwapi

PathFileExistsW

setupapi

SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiCreateDeviceInfoList
SetupDiOpenDeviceInterfaceW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces

vssapi

CreateVssBackupComponentsInternal

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

clusapi

OpenCluster
CloseCluster

api-ms-win-security-lsalookup-l1-1-0

LookupAccountSidLocalW

Sections

.text
Size: 327KB - Virtual size: 327KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

888742b8dd20542042b35143c687bdb7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcrt

ole32

user32

oleaut32

rpcrt4

ntdll

shlwapi

setupapi

vssapi

version

clusapi

api-ms-win-security-lsalookup-l1-1-0

Sections

.text Size: 327KB - Virtual size: 327KB

.rdata Size: 160KB - Virtual size: 159KB

.data Size: 5KB - Virtual size: 140KB

.pdata Size: 10KB - Virtual size: 9KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 1.2MB - Virtual size: 1.2MB

.text
Size: 327KB - Virtual size: 327KB

.rdata
Size: 160KB - Virtual size: 159KB

.data
Size: 5KB - Virtual size: 140KB

.pdata
Size: 10KB - Virtual size: 9KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 1.2MB - Virtual size: 1.2MB