NEAS[.]4c347a26193dbbfd8cfb5395d8fad8c0[.]exe | Triage

Sharing

General

Target

NEAS.4c347a26193dbbfd8cfb5395d8fad8c0.exe
Size

5KB
MD5

4c347a26193dbbfd8cfb5395d8fad8c0
SHA1

fe4cf5fe236c3b5c9e8f4a95f825489aac97e832
SHA256

d8e61db77cd5f87a6bbd401b01b2b97bcc16756780b48d6918fed6bf38228c22
SHA512

2ba9815be634b29de5cce6fb7044467b2f62964f7550b17bf18981e27e407d4b6efc15e8e4b3d6feac1e12a7c43e5ddcfdbb92a5782ef5cff9ef517d6665b57c
SSDEEP

96:VtHNXvISjrvTyzJUDphOJ9IdcTrtzB/1ora:nNXvbXWdCphOJ9//1ora

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.4c347a26193dbbfd8cfb5395d8fad8c0.exe

Files

NEAS.4c347a26193dbbfd8cfb5395d8fad8c0.exe
.exe windows:4 windows x64

e06d10679bfff64808eaec6fde0e1077

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

LocalAlloc
GetSystemTime
Sleep
ExpandEnvironmentStringsA

msvcrt

memmove
printf
system
_vsnprintf
__set_app_type
_controlfp
__argc
__argv
_environ
__getmainargs
exit

urlmon

URLDownloadToFileA

snmpapi

SnmpUtilOidAppend
SnmpUtilVarBindCpy
SnmpUtilOidFree
SnmpUtilPrintOid
SnmpUtilMemReAlloc
SnmpUtilVarBindFree
SnmpUtilOidNCmp
SnmpUtilOidToA

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ