NEAS[.]7a41171eb719f26e5e4ab628ba003c90[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.7a41171eb719f26e5e4ab628ba003c90.exe
Size

6KB
MD5

7a41171eb719f26e5e4ab628ba003c90
SHA1

386534f9b033929e69525c7bf2a465e8e30090a7
SHA256

a9d9531a83e965649977d0085d8eccf9e95c2153284559a3915e364322e3595b
SHA512

b280f4c7bd6cae512cd7ea031c44f323358d68b4ee66eabc69019e295ffb6aa963db1aac7c8546b12cac994c0601746cd6b60b626d98a1f5448726b589ca5563
SSDEEP

96:qtHGXLyhFw0olqLHPiue9n99pTrTj3C44oru:sGXIFw0ogvib999N2oru

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.7a41171eb719f26e5e4ab628ba003c90.exe

Files

NEAS.7a41171eb719f26e5e4ab628ba003c90.exe
.exe windows:4 windows x64

fa161855db5ed0cf47c140a9fcecfc93

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

LocalAlloc
GetSystemTime
Sleep
ExpandEnvironmentStringsA

msvcrt

memmove
printf
system
_vsnprintf
__set_app_type
_controlfp
__argc
__argv
_environ
__getmainargs
exit

urlmon

URLDownloadToFileA

snmpapi

SnmpUtilOctetsCpy
SnmpUtilOctetsFree
SnmpUtilOidCpy
SnmpUtilOidFree
SnmpUtilPrintAsnAny
SnmpUtilMemReAlloc
SnmpSvcGetUptime
SnmpUtilVarBindFree
SnmpUtilOidNCmp
SnmpUtilIdsToA
SnmpUtilOctetsNCmp

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ