42b3a1cd7eb9890bac69785906ade170_NEAS

Sharing

Copy URL

Twitter E-mail

General

Target

42b3a1cd7eb9890bac69785906ade170_NEAS
Size

215KB
MD5

42b3a1cd7eb9890bac69785906ade170
SHA1

5ebeb23e14123f821d707e952d869861a8c92a97
SHA256

329d99dd402ca5f3598bb48204558fe816d3c9c9a688e6ec72db5e640a05bba4
SHA512

4f453d417c21c4c5ea69b8e4aff019d8ac64272c5893c3afdb5ebfb3b939d0b3be11d162acd689fe8ab4cfb81826ddbdc900aa4c2195e58672a98d10ce06a9a9
SSDEEP

6144:1JjnEwEGm8iGiiRjTDSf/AJy4RZYoLaqL8n:1JQnJGiiRfDSfSbYoVw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
42b3a1cd7eb9890bac69785906ade170_NEAS

Files

42b3a1cd7eb9890bac69785906ade170_NEAS
.dll windows:6 windows x86 arch:x86

b1cf7cb9f47d71a492be9417ceded4ee

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\【开源witkey】\【20】远程桌面\新叶\Container\Release\RcKernelPlug.pdb

Imports

shell32

CommandLineToArgvW
SHGetFolderPathA
SHGetFileInfoA
ShellExecuteExA
ShellExecuteA
SHGetSpecialFolderPathA

netapi32

Netbios

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationA
WTSQueryUserToken
WTSEnumerateSessionsA

shlwapi

PathFileExistsA

kernel32

lstrcatA
GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
GetLastError
GetFileAttributesA
LoadLibraryA
GetVersionExA
Process32Next
lstrcpyA
GetLocalTime
GetProcAddress
LocalFree
lstrcmpiA
CreateProcessA
ReadFile
MoveFileA
FindFirstFileA
GetDriveTypeA
FindNextFileA
SetFilePointer
FindClose
GetVolumeInformationA
LocalAlloc
DeleteFileA
SetFileAttributesA
GetLogicalDriveStringsA
GetFileSize
RemoveDirectoryA
LocalReAlloc
GetDiskFreeSpaceExA
CreateDirectoryA
IsWow64Process
LocalSize
GetCommandLineW
CreateMutexA
ReleaseMutex
GetCommandLineA
GetSystemWow64DirectoryA
ExitProcess
GetTickCount
GetModuleFileNameA
WriteProcessMemory
SuspendThread
CopyFileA
GetNativeSystemInfo
VirtualAllocEx
CreateRemoteThread
HeapFree
GetCurrentThreadId
GetLocaleInfoW
ResumeThread
TerminateThread
HeapAlloc
GetThreadContext
ReadProcessMemory
GetCurrentProcessId
GetProcessHeap
GlobalMemoryStatusEx
SetThreadContext
FileTimeToSystemTime
GetSystemInfo
LoadLibraryW
FreeLibrary
SystemTimeToTzSpecificLocalTime
GetFileTime
GetComputerNameA
K32GetProcessImageFileNameA
QueryDosDeviceA
K32GetProcessMemoryInfo
GlobalAlloc
GlobalFree
GetPriorityClass
K32EnumProcessModules
InitializeSListHead
CreateFileW
GetStringTypeW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetTimeZoneInformation
WideCharToMultiByte
MultiByteToWideChar
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetFileType
GetStdHandle
RtlUnwind
LCMapStringW
CompareStringW
lstrlenA
GetCurrentProcess
Process32First
GetPrivateProfileStringA
WritePrivateProfileStringA
GetSystemDirectoryA
CreateFileA
WriteFile
CreateEventA
ResetEvent
CloseHandle
SetEvent
Sleep
WaitForSingleObject
CancelIo
VirtualAlloc
VirtualFree
FlushFileBuffers
SetStdHandle
HeapSize
HeapReAlloc
WriteConsoleW
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
TerminateProcess
DecodePointer
GetTimeFormatW
GetDateFormatW
GetModuleFileNameW
RaiseException
InterlockedFlushSList
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
SetLastError
GetStartupInfoW

user32

ExitWindowsEx
OpenInputDesktop
OpenDesktopA
CloseDesktop
wsprintfA
GetThreadDesktop
SetThreadDesktop
GetUserObjectInformationA
CharNextA
GetWindowDisplayAffinity
EnumWindows
GetWindowTextA
GetClassNameA
GetWindowThreadProcessId
FindWindowA
GetSystemMetrics
GetLastInputInfo
GetWindow

advapi32

SetTokenInformation
ConvertStringSidToSidA
GetLengthSid
DuplicateTokenEx
CreateServiceA
UnlockServiceDatabase
CloseServiceHandle
OpenSCManagerA
LockServiceDatabase
DeleteService
ChangeServiceConfigA
StartServiceA
ChangeServiceConfig2A
OpenServiceA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AdjustTokenPrivileges
CreateProcessAsUserA
RegCloseKey
RegDeleteKeyA
RegQueryValueExA
LookupPrivilegeValueA
RegCreateKeyExA
GetUserNameA
RegQueryValueA
RegSetValueExA
LookupAccountSidA
OpenProcessToken
RegOpenKeyExA
RegDeleteValueA
GetTokenInformation

ole32

CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VariantClear
VariantInit

wininet

InternetOpenUrlA
InternetOpenA
InternetCloseHandle
InternetReadFile

ws2_32

gethostbyname
setsockopt
htons
recv
connect
socket
send
getsockname
select
WSAStartup
closesocket
WSAIoctl
WSACleanup
inet_ntoa

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

Exports

Exports

run

Sections

.text
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b1cf7cb9f47d71a492be9417ceded4ee

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shell32

netapi32

wtsapi32

shlwapi

kernel32

user32

advapi32

ole32

oleaut32

wininet

ws2_32

userenv

Exports

Exports

Sections

.text Size: 164KB - Virtual size: 164KB

.rdata Size: 38KB - Virtual size: 37KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 164KB - Virtual size: 164KB

.rdata
Size: 38KB - Virtual size: 37KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 8KB - Virtual size: 7KB