NEAS[.]870483aa29eb9d5bae1df8ac6a261470[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.870483aa29eb9d5bae1df8ac6a261470.exe
Size

473KB
MD5

870483aa29eb9d5bae1df8ac6a261470
SHA1

10a54b65ae7669dbb9e1c93d96e612e0f992b3e7
SHA256

1e0f3119c43e653399f75020ee22ba426181d3fd333f410ac263a3e7df2af581
SHA512

a7a580a42c62c449238c20ce1a5809b806a0e9d5108c1ebec9cde84be4979369b057d5b0492a53d6aa1863a36c2e1536edc3f33288b7fa2d83bb3c1506cd5c5f
SSDEEP

12288:ksGBCbqxQ2TFLmJwhhgEAz2abn3KYHog6+v9ZptymaGt:kh4qOimeh+b2aL6i6+v9Bb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.870483aa29eb9d5bae1df8ac6a261470.exe

Files

NEAS.870483aa29eb9d5bae1df8ac6a261470.exe
.dll windows:4 windows x86

74dc7115008eff6a49c32d48eb51211a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

OleUninitialize

comctl32

ImageList_SetIconSize

shell32

SHGetFileInfoA

Sections

CODE
Size: 461KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE