NEAS[.]490f9fc10bbd99a893fea710aa0d40d0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.490f9fc10bbd99a893fea710aa0d40d0.exe
Size

33KB
MD5

490f9fc10bbd99a893fea710aa0d40d0
SHA1

2ddb17aea628a6dbb72f1f5ec7f03911f3f411bc
SHA256

178f62f30d13212dd7c5ab2a350823c0a54d54ef7d3561062a1864ba0e5e8c3b
SHA512

9c583e739c008b2e47e01400a2c64b0550d58c846af2d2bf3fa924d6e6e95adf32db95a0107644a65a4285786400b2f951ed34fbae37801f7b2ebd24646d2fd8
SSDEEP

768:uy5Fys31Kjpz8FOcTP4wAt3abq1A3OJ5CcOuQRjRdpD:fysl818FOcT743a9W5BOuQFR7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.490f9fc10bbd99a893fea710aa0d40d0.exe

Files

NEAS.490f9fc10bbd99a893fea710aa0d40d0.exe
.dll regsvr32 windows:4 windows x86

b6e8f33157f289372e6b85fa720839cc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

MessageBoxW

advapi32

RegDeleteKeyA

ole32

CoTaskMemRealloc

oleaut32

VariantClear

msvcrt

wcscpy

wininet

HttpQueryInfoA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 22KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE