2f24149c83601f57f5e5fa75d9b9cfe0_NEAS

Sharing

Copy URL Twitter E-mail

General

Target

2f24149c83601f57f5e5fa75d9b9cfe0_NEAS
Size

1.5MB
MD5

2f24149c83601f57f5e5fa75d9b9cfe0
SHA1

c0d00d276e6c501e8d5bfc4f93506368c542e923
SHA256

c91eae7b8e7342ca28e5b20a5ac42fe80a8b08ad9a62371eada7acbfcbee6a3f
SHA512

16029b80d3cf1661f54df9ab84ffed1fc2e723365634cb2498509cb2792c14a36df67ab51dfba66525263b6b24e64632afdc2cf26c544ae16c34702eb30f40ef
SSDEEP

12288:kfTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWc4D:kfTduSZpUR0GHrVQ1aW4mSOgv3isi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2f24149c83601f57f5e5fa75d9b9cfe0_NEAS

Files

2f24149c83601f57f5e5fa75d9b9cfe0_NEAS
.exe windows:6 windows x86 arch:x86

54edfd04b98c5d6716247e4c88e1f6e2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\a01\_work\39\s\\binaries\x86ret\bin\i386\GuidGen.pdb

Imports

kernel32

GetFileAttributesW
GetUserDefaultUILanguage
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleW
GlobalAlloc
GlobalLock
GlobalUnlock
InitializeCriticalSectionEx
GetLastError
DeleteCriticalSection
CloseHandle
InitializeCriticalSectionAndSpinCount
CreateEventW
GetProcAddress
OutputDebugStringW
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter

vcruntime140

__CxxFrameHandler3
__current_exception
__current_exception_context
memset
_except_handler4_common
memcpy

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s
_set_fmode
__p__commode

api-ms-win-crt-runtime-l1-1-0

_exit
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
exit
_configure_wide_argv
_initterm_e
_initterm
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_controlfp_s
_errno
_invalid_parameter_noinfo
_set_app_type
terminate
_get_wide_winmain_command_line
_initialize_wide_environment
_seh_filter_exe

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

mfc140u

ord14466
ord11983
ord11982
ord2034
ord7941
ord12947
ord4090
ord4152
ord9398
ord14595
ord7922
ord14589
ord12542
ord12541
ord2486
ord5357
ord8324
ord12865
ord8386
ord8470
ord12884
ord8360
ord458
ord7493
ord10472
ord2750
ord2215
ord3797
ord4485
ord2246
ord296
ord8464
ord2383
ord3833
ord890
ord1391
ord11038
ord14507
ord13473
ord4815
ord6531
ord9210
ord10255
ord5790
ord12168
ord3265
ord3371
ord3372
ord3941
ord12124
ord2682
ord5935
ord13703
ord11717
ord6877
ord14596
ord7923
ord14590
ord3055
ord4494
ord9693
ord4502
ord4988
ord6350
ord4912
ord4974
ord5019
ord4942
ord4997
ord5013
ord4954
ord4960
ord8000
ord4948
ord5003
ord4936
ord1777
ord1756
ord1770
ord1744
ord1722
ord12258
ord12262
ord13878
ord3266
ord9256
ord11002
ord6978
ord12172
ord8965
ord14588
ord11936
ord3838
ord12089
ord9139
ord11726
ord11725
ord5652
ord10288
ord10284
ord10286
ord10287
ord10285
ord14785
ord2760
ord8210
ord3302
ord3305
ord13752
ord6218
ord3164
ord3403
ord3404
ord11396
ord9040
ord12131
ord11015
ord2409
ord14668
ord2303
ord13911
ord1472
ord995
ord7653
ord1045
ord286
ord6349
ord3852
ord5918
ord14667
ord12531
ord12239
ord12247
ord6348
ord8217
ord10433
ord12251
ord12219
ord12928
ord5249
ord5549
ord5760
ord9350
ord5525
ord5763
ord4966
ord5252
ord5411
ord5228
ord7722
ord7723
ord14669
ord7712
ord5409
ord8219
ord10250
ord9209
ord6860
ord4589
ord1111
ord4092
ord4927
ord4886
ord4885

user32

GetParent
GetSystemMetrics
LoadIconW
IsIconic
AppendMenuW
GetSystemMenu
SendMessageW
EnableWindow
GetClientRect
GetForegroundWindow
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
DrawIcon

ole32

CoInitialize
CoUninitialize
CoCreateGuid

rpcrt4

UuidCreate

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.4MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

54edfd04b98c5d6716247e4c88e1f6e2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

mfc140u

user32

ole32

rpcrt4

Sections

.text Size: 12KB - Virtual size: 11KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 3KB

.rsrc Size: 7KB - Virtual size: 6KB

.reloc Size: 1.4MB - Virtual size: 2.3MB

.text
Size: 12KB - Virtual size: 11KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 7KB - Virtual size: 6KB

.reloc
Size: 1.4MB - Virtual size: 2.3MB