NEAS[.]1e0600320d43f225f7bc720ba308b4e0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.1e0600320d43f225f7bc720ba308b4e0.exe
Size

25KB
MD5

1e0600320d43f225f7bc720ba308b4e0
SHA1

232f54c2df737b904d526712078f29162b7c4281
SHA256

cf6ab5f1ffda8caf5eaee20bb1651d20db5fffbedcf8e4fa5b13e43a3dbfd44c
SHA512

f8cdf35ef4cf554dbb17fc21390969295ae02d9aec60380dacc9c974f2fc669496224a164627d23a5cbd9bdba27369ee8d50a4d88340211fcedf9ea25de9c4c3
SSDEEP

192:cgOpFJdzOrSgYBxpqm5Lpv83LNNEt8vjfcfVowgggggggggggggggbgNnw1+jQcv:cgOvJdqOxpqm5LpvmLwtlO0kake

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.1e0600320d43f225f7bc720ba308b4e0.exe

Files

NEAS.1e0600320d43f225f7bc720ba308b4e0.exe
.exe windows:4 windows x86

e1894de59266b62f743d38ca0eda457b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

PostQuitMessage
SendMessageW
DestroyWindow
DefWindowProcW
CreateWindowExW
LoadCursorW
LoadIconW
RegisterClassExW
LoadAcceleratorsW
GetMessageW
TranslateMessage
DispatchMessageW

kernel32

lstrcpynW
lstrcatW
GetCommandLineW
LoadLibraryW
GetTempPathW
ReadFile
CreateFileW
GetTickCount
GetModuleHandleA
GetProcessHeap
GetStartupInfoA
GetCommandLineA
HeapAlloc
GetModuleHandleW
ExitProcess

gdi32

TextOutW
SetTextAlign
SetBkColor
DeleteObject
GetBkColor
GetStockObject
CreateSolidBrush

comctl32

InitCommonControlsEx

shell32

CommandLineToArgvW

advapi32

RegOpenKeyExA
RegCloseKey
RegQueryValueExA

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ