ebe10a19fb6c42cacbb76eeabe657090_NEAS

Sharing

Copy URL Twitter E-mail

General

Target

ebe10a19fb6c42cacbb76eeabe657090_NEAS
Size

1.2MB
MD5

ebe10a19fb6c42cacbb76eeabe657090
SHA1

bcb6e78592f11df4900a4f299c705e255722069a
SHA256

8e706b0d1117a536a078ddd69d4f907cde66bb0151fcd46c5cc97eb78b4e8187
SHA512

cbe806c460a3af39904749ce87f04629eb07912209f3f2d8ebcde1442109e046841aba2a376ed40e9afde5a4f24c81a1817c296d77c78523818d5c26a9ef07a1
SSDEEP

12288:CktQ+LewXmQrIFnvaR8cKR1nCHEqosaJFJ3k98YcD:CNLwexaR8cKR5CkJJFJ3ShcD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ebe10a19fb6c42cacbb76eeabe657090_NEAS

Files

ebe10a19fb6c42cacbb76eeabe657090_NEAS
.exe windows:4 windows x64 arch:x64

2c2ae3a2b11f28a67aff8778e89d7044

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

epdevmgr

ord10
ord22
ord12
ord35
ord20
ord24
ord15
ord16

kernel32

GetLastError
MapViewOfFileEx
OpenFileMappingA
CloseHandle
UnmapViewOfFile
SetEvent
OpenEventA
CreateMutexA
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoA
Sleep
GetSystemTimeAsFileTime

user32

LoadCursorA
GetMessageA
TranslateMessage
DispatchMessageA
SystemParametersInfoA
CreateWindowExA
RegisterClassExA
DefWindowProcA
PostQuitMessage
DestroyWindow
IsWindow
SendMessageA
RegisterWindowMessageA
ShowWindow

msvcr80

_exit
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
free
memcpy
calloc
??3@YAXPEAX@Z
_mbsrchr
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
fflush
fprintf
vsprintf
_strtime
??2@YAPEAX_K@Z
__CxxFrameHandler3
_mbsnbicmp
_amsg_exit
__getmainargs
__C_specific_handler
_XcptFilter
_ismbblead
_cexit
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
_encode_pointer
__set_app_type
?terminate@@YAXXZ

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 400B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.2MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2c2ae3a2b11f28a67aff8778e89d7044

Headers

DLL Characteristics

File Characteristics

Imports

epdevmgr

kernel32

user32

msvcr80

Sections

.text Size: 10KB - Virtual size: 10KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 400B

.pdata Size: 1024B - Virtual size: 792B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1.2MB - Virtual size: 1.8MB

.text
Size: 10KB - Virtual size: 10KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 400B

.pdata
Size: 1024B - Virtual size: 792B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1.2MB - Virtual size: 1.8MB