NEAS[.]5ffce71b84f3a63d11fcba6d76340b00[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.5ffce71b84f3a63d11fcba6d76340b00.exe
Size

236KB
MD5

5ffce71b84f3a63d11fcba6d76340b00
SHA1

cef76f8e545e95b291a679a917362628efbf15d7
SHA256

18cc580f0d8dd77e8a2c31ae31d9d7d1bda837f836d1709456392ad98033abc4
SHA512

532186279c7b2f33e4e5afdc565f726a90b9d766601c2f72aa8eea44fb9d6e0d7da29d8ef357539e70fd9ce1f300fa06950dae22382dca914eccf4159c1fb073
SSDEEP

6144:dbJsc8+sAlNfVdSGB+YK/udJVanrNhCi4TTqIp/Z:DsczsUjSGB+TzCiQZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.5ffce71b84f3a63d11fcba6d76340b00.exe

Files

NEAS.5ffce71b84f3a63d11fcba6d76340b00.exe
.exe windows:4 windows x86

cc570816b5cc36584ba3f0b5cdabbde5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadResource
LoadLibraryA
LockResource
ExitProcess

msvbvm60

MethCallEngine
ord516
ord631
ord525
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord712
ord608
ord717
ProcCallEngine
ord537
ord644
ord100

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 208KB - Virtual size: 207KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ