d2cf1c107f23c1737a44b4b60c0377e0_NEAS

Sharing

Copy URL Twitter E-mail

General

Target

d2cf1c107f23c1737a44b4b60c0377e0_NEAS
Size

215KB
MD5

d2cf1c107f23c1737a44b4b60c0377e0
SHA1

ca89bbf6df2e400f15fe92d8294cc365cbf60392
SHA256

3679d0da4989c6f5cba34e0a8d3377f77e2dafee435963565c2a3341ba3e8439
SHA512

a5cab14879c062eac0f46496297930865b23bde2c434669240a7427041a01d7c8d9568b592965ae72c14f837696de1e25acbc7ab7dad9ade18afef6afad4394e
SSDEEP

6144:rJjnEwEGm8iGiiRjTDSf/AJy4RZYoLaqL8n:rJQnJGiiRfDSfSbYoVw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d2cf1c107f23c1737a44b4b60c0377e0_NEAS

Files

d2cf1c107f23c1737a44b4b60c0377e0_NEAS
.dll windows:6 windows x86 arch:x86

b1cf7cb9f47d71a492be9417ceded4ee

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\【开源witkey】\【20】远程桌面\新叶\Container\Release\RcKernelPlug.pdb

Imports

shell32

CommandLineToArgvW
SHGetFolderPathA
SHGetFileInfoA
ShellExecuteExA
ShellExecuteA
SHGetSpecialFolderPathA

netapi32

Netbios

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationA
WTSQueryUserToken
WTSEnumerateSessionsA

shlwapi

PathFileExistsA

kernel32

lstrcatA
GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
GetLastError
GetFileAttributesA
LoadLibraryA
GetVersionExA
Process32Next
lstrcpyA
GetLocalTime
GetProcAddress
LocalFree
lstrcmpiA
CreateProcessA
ReadFile
MoveFileA
FindFirstFileA
GetDriveTypeA
FindNextFileA
SetFilePointer
FindClose
GetVolumeInformationA
LocalAlloc
DeleteFileA
SetFileAttributesA
GetLogicalDriveStringsA
GetFileSize
RemoveDirectoryA
LocalReAlloc
GetDiskFreeSpaceExA
CreateDirectoryA
IsWow64Process
LocalSize
GetCommandLineW
CreateMutexA
ReleaseMutex
GetCommandLineA
GetSystemWow64DirectoryA
ExitProcess
GetTickCount
GetModuleFileNameA
WriteProcessMemory
SuspendThread
CopyFileA
GetNativeSystemInfo
VirtualAllocEx
CreateRemoteThread
HeapFree
GetCurrentThreadId
GetLocaleInfoW
ResumeThread
TerminateThread
HeapAlloc
GetThreadContext
ReadProcessMemory
GetCurrentProcessId
GetProcessHeap
GlobalMemoryStatusEx
SetThreadContext
FileTimeToSystemTime
GetSystemInfo
LoadLibraryW
FreeLibrary
SystemTimeToTzSpecificLocalTime
GetFileTime
GetComputerNameA
K32GetProcessImageFileNameA
QueryDosDeviceA
K32GetProcessMemoryInfo
GlobalAlloc
GlobalFree
GetPriorityClass
K32EnumProcessModules
InitializeSListHead
CreateFileW
GetStringTypeW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetTimeZoneInformation
WideCharToMultiByte
MultiByteToWideChar
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetFileType
GetStdHandle
RtlUnwind
LCMapStringW
CompareStringW
lstrlenA
GetCurrentProcess
Process32First
GetPrivateProfileStringA
WritePrivateProfileStringA
GetSystemDirectoryA
CreateFileA
WriteFile
CreateEventA
ResetEvent
CloseHandle
SetEvent
Sleep
WaitForSingleObject
CancelIo
VirtualAlloc
VirtualFree
FlushFileBuffers
SetStdHandle
HeapSize
HeapReAlloc
WriteConsoleW
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
TerminateProcess
DecodePointer
GetTimeFormatW
GetDateFormatW
GetModuleFileNameW
RaiseException
InterlockedFlushSList
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
SetLastError
GetStartupInfoW

user32

ExitWindowsEx
OpenInputDesktop
OpenDesktopA
CloseDesktop
wsprintfA
GetThreadDesktop
SetThreadDesktop
GetUserObjectInformationA
CharNextA
GetWindowDisplayAffinity
EnumWindows
GetWindowTextA
GetClassNameA
GetWindowThreadProcessId
FindWindowA
GetSystemMetrics
GetLastInputInfo
GetWindow

advapi32

SetTokenInformation
ConvertStringSidToSidA
GetLengthSid
DuplicateTokenEx
CreateServiceA
UnlockServiceDatabase
CloseServiceHandle
OpenSCManagerA
LockServiceDatabase
DeleteService
ChangeServiceConfigA
StartServiceA
ChangeServiceConfig2A
OpenServiceA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AdjustTokenPrivileges
CreateProcessAsUserA
RegCloseKey
RegDeleteKeyA
RegQueryValueExA
LookupPrivilegeValueA
RegCreateKeyExA
GetUserNameA
RegQueryValueA
RegSetValueExA
LookupAccountSidA
OpenProcessToken
RegOpenKeyExA
RegDeleteValueA
GetTokenInformation

ole32

CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VariantClear
VariantInit

wininet

InternetOpenUrlA
InternetOpenA
InternetCloseHandle
InternetReadFile

ws2_32

gethostbyname
setsockopt
htons
recv
connect
socket
send
getsockname
select
WSAStartup
closesocket
WSAIoctl
WSACleanup
inet_ntoa

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

Exports

Exports

run

Sections

.text
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b1cf7cb9f47d71a492be9417ceded4ee

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shell32

netapi32

wtsapi32

shlwapi

kernel32

user32

advapi32

ole32

oleaut32

wininet

ws2_32

userenv

Exports

Exports

Sections

.text Size: 164KB - Virtual size: 164KB

.rdata Size: 38KB - Virtual size: 37KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 164KB - Virtual size: 164KB

.rdata
Size: 38KB - Virtual size: 37KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 8KB - Virtual size: 7KB