NEAS[.]5489e628f878a5c0eb30d83307221790[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.5489e628f878a5c0eb30d83307221790.exe
Size

5KB
MD5

5489e628f878a5c0eb30d83307221790
SHA1

3a459bb7bcf0eef423a052d7f616d9e5d3e1d7ed
SHA256

e4f1b9900934c7ea849f042e9fa558da7083fcb7379b1820db7cb4dbc462b44c
SHA512

79375db6e09ddc21957c37f8c4959f5f9878e653d2b12620347d572a6ae971aa35f22e4ad08e490846c53baacad148980ebdfcbf1a5ad908bd09dc7531455dbf
SSDEEP

96:ctHdXgevMfZpp/r4xLdOmTrs62ipWpGor+:+dXjMfZp2hdOa2iswor+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.5489e628f878a5c0eb30d83307221790.exe

Files

NEAS.5489e628f878a5c0eb30d83307221790.exe
.exe windows:4 windows x64

39098b9c4fda6e0b7da034002a4bd291

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

LocalAlloc
GetSystemTime
Sleep
ExpandEnvironmentStringsA

msvcrt

memmove
printf
system
_vsnprintf
__set_app_type
_controlfp
__argc
__argv
_environ
__getmainargs
exit

urlmon

URLDownloadToFileA

snmpapi

SnmpUtilOctetsCpy
SnmpUtilVarBindCpy
SnmpUtilOidFree
SnmpUtilMemFree
SnmpUtilMemReAlloc
SnmpSvcGetUptime
SnmpUtilVarBindFree
SnmpUtilOidToA
SnmpUtilIdsToA

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ