NEAS[.]1f955c1c75daf2a04949cb65bcf343e0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.1f955c1c75daf2a04949cb65bcf343e0.exe
Size

32KB
MD5

1f955c1c75daf2a04949cb65bcf343e0
SHA1

9f899332bb7ba23d2828b04a96502e5397199904
SHA256

255ce9ab58645c3412969daa5752a44fa7c34f4b08003c4adea260ea558d6d38
SHA512

4f7f7e950ac0c135050619a0cadb7a48b3c114fcc1fa459f91aebe63ffc84dd6d97038110b4a4ac31ad338711656fe760b911d3b664eef68b652e01c9d93a0fa
SSDEEP

768:necBPfNm1KNpCx9D9p/qpxsR3FitHUbt58C61Vp:necVNEb9cC3Fit0UCeV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.1f955c1c75daf2a04949cb65bcf343e0.exe

Files

NEAS.1f955c1c75daf2a04949cb65bcf343e0.exe
.exe windows:4 windows x86

b913185f2e205b1af04ae0e2a4770acf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

AreAllAccessesGranted

kernel32

MulDiv

msvbvm60

ord183
ord585
ord665
ord669
EVENT_SINK_AddRef
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord717
ProcCallEngine
ord644
ord570
ord100
ord432

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 580B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ