97f541fb96cebfaef06a923b0194d9d0_NEAS

Sharing

Copy URL Twitter E-mail

General

Target

97f541fb96cebfaef06a923b0194d9d0_NEAS
Size

360KB
MD5

97f541fb96cebfaef06a923b0194d9d0
SHA1

e78650993db1755298c7d3cbd1b65b562e5b10d6
SHA256

279e90d1d63b77c1b30bba14c4bd159f5bb3c450273fac2e20fff9233817c6a9
SHA512

395e58e7ca302ecd10ee922b07db0391d7d0ffb1251b4d533ab6fd430bdcba02d46ea6dd849c26f0c75adec1ea64138e021ba70497acdceed8452777d7c23233
SSDEEP

6144:N+v8V/ebQQ9R/DwxLn7dX9K13XTu+4GtBY3iUEQrDVDr7XJXuzrru4PXJesZmuyl:N+v8V2bQQ9RkVeXj/4ZDr7YznHPEs4u2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
97f541fb96cebfaef06a923b0194d9d0_NEAS

Files

97f541fb96cebfaef06a923b0194d9d0_NEAS
.dll regsvr32 windows:4 windows x86 arch:x86

6df230e4eb1d704df0a17dff2a8316e4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LocalAlloc
LoadLibraryA
GetVersionExA
RaiseException
GetFileSize
ReadFile
CloseHandle
InterlockedDecrement
InterlockedIncrement
DisableThreadLibraryCalls
GetProcAddress
DeleteCriticalSection
InitializeCriticalSection
GetLastError
FreeLibrary
InterlockedExchange
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcess
FlushInstructionCache
lstrlenA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
WideCharToMultiByte
SizeofResource
LockResource
LoadResource
MultiByteToWideChar
GetSystemDefaultLCID

gdi32

GetTextColor
GetBkMode
SetTextColor
SetBkMode
MoveToEx
LineTo
TextOutW
CreatePen
GetStockObject
GetDeviceCaps
SelectObject
CreateSolidBrush
Rectangle
CreatePalette
SelectPalette
RealizePalette
DeleteObject

user32

GetClientRect
IsRectEmpty
SetRectEmpty
UnregisterClassA
ShowWindow
GetParent
IsWindowEnabled
GetActiveWindow
SendMessageA
IsChild
IsWindowVisible
DestroyWindow
MapWindowPoints
SetWindowPos
OffsetRect
BringWindowToTop
EndDialog
IsWindowUnicode
EnableWindow
GetWindowRect
ScreenToClient
MoveWindow
FillRect
IsWindow
SetScrollPos
GetDlgItem
EnumChildWindows
GetSysColorBrush
SetFocus
BeginPaint
GetSysColor
InflateRect
GetFocus
DrawFocusRect
EndPaint
GetDC
InvalidateRect
ReleaseDC

comctl32

ImageList_Destroy

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

ole32

OleRun
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree

oleaut32

VarBstrCat
VariantCopy
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
SysFreeString
SysAllocStringLen
SysAllocString
SysStringLen
VariantInit
VariantClear
VariantChangeType
LoadRegTypeLi

msvcr70

wcscat
towlower
wcsncmp
_wcsnicmp
vswprintf
_vscwprintf
wcschr
wcsstr
wcscmp
memmove
_purecall
realloc
free
wcsrchr
_except_handler3
wcslen
memset
wcsncpy
wcstoul
_wcsicmp
wcscpy
swprintf
??2@YAPAXI@Z
??_U@YAPAXI@Z
??_V@YAXPAX@Z
??3@YAXPAX@Z
_initterm
_adjust_fdiv
__dllonexit
_onexit
malloc

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
VSDllRegisterServer
VSDllUnregisterServer

Sections

.text
Size: 88KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 244KB - Virtual size: 244KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6df230e4eb1d704df0a17dff2a8316e4

Headers

File Characteristics

Imports

kernel32

gdi32

user32

comctl32

advapi32

ole32

oleaut32

msvcr70

Exports

Exports

Sections

.text Size: 88KB - Virtual size: 85KB

.data Size: 12KB - Virtual size: 10KB

.rsrc Size: 12KB - Virtual size: 10KB

.reloc Size: 244KB - Virtual size: 244KB

.text
Size: 88KB - Virtual size: 85KB

.data
Size: 12KB - Virtual size: 10KB

.rsrc
Size: 12KB - Virtual size: 10KB

.reloc
Size: 244KB - Virtual size: 244KB