NEAS[.]5bfed6a5e47bfd48e5af94129d894f20[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.5bfed6a5e47bfd48e5af94129d894f20.exe
Size

5KB
MD5

5bfed6a5e47bfd48e5af94129d894f20
SHA1

a9e6bfa07572e822a19b2e3f2d0b3ac7b003f41e
SHA256

0ecb7c1ac38bf58c43f20f1908ceec465a6515f33d9fda3f25683f4837d8b588
SHA512

5b9d39322697ca611b13db892a488971387587b48bcf5585569a734c44bebbf1f1a37d1f8b5c37a67368c47b6c27d3c544171424dc65164a3b8150839c049467
SSDEEP

96:ltHNXvISjGvTyzGn8gjOJ9IdcTrILIzBsuorH:3NXvb2WyTjOJ9A8suorH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.5bfed6a5e47bfd48e5af94129d894f20.exe

Files

NEAS.5bfed6a5e47bfd48e5af94129d894f20.exe
.exe windows:4 windows x64

681438f5c1f59d0ab850f741f9ca8b35

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

LocalAlloc
GetSystemTime
Sleep
ExpandEnvironmentStringsA

msvcrt

memmove
printf
system
_vsnprintf
__set_app_type
_controlfp
__argc
__argv
_environ
__getmainargs
exit

urlmon

URLDownloadToFileA

snmpapi

SnmpUtilOctetsCpy
SnmpUtilVarBindCpy
SnmpUtilPrintOid
SnmpUtilMemFree
SnmpSvcGetUptime
SnmpUtilVarBindFree
SnmpUtilOidNCmp
SnmpUtilOctetsNCmp

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ