NEAS[.]201703474418f94a8fc59d8fc25808d0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.201703474418f94a8fc59d8fc25808d0.exe
Size

26KB
MD5

201703474418f94a8fc59d8fc25808d0
SHA1

499b86a7646a46b4427d12d2b1c1b06799077ed8
SHA256

1dc78ccd9e677f650a0468586faf5bd339021a916d413baf96bcc8a83821fce7
SHA512

6aa540a6e9b0e29b433ba400a439afa65930709eae95f12cbc42108dbb7fcd5efa979ba5f576ea26af0a9812cc745bf1a3f6d0feef69e26f436514193aab93ec
SSDEEP

768:Fh8YeOa3xfdNVOOixXceyVr5ltEn2G0Qwk7b:FDeO0xlbdixAr3qn2GXv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.201703474418f94a8fc59d8fc25808d0.exe

Files

NEAS.201703474418f94a8fc59d8fc25808d0.exe
.exe windows:4 windows x86

9b707a8a5c1246de3bb346158a594864

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

EnterCriticalSection
VirtualProtect
InitializeCriticalSection
GetModuleHandleA
HeapAlloc
GetProcessHeap
TerminateProcess
VirtualAllocEx
HeapFree
VirtualAlloc
lstrlenA
lstrcpyA
WritePrivateProfileStringA
GetTempPathA
CloseHandle
WriteFile
SetFilePointer
ExitProcess
ReadFile
GetFileSize
CreateFileA
CopyFileA
GetModuleFileNameA
lstrcatA
GetProcAddress
GetLastError
LeaveCriticalSection

user32

MessageBoxA

advapi32

CryptGenRandom
CryptAcquireContextA
CryptReleaseContext

Exports

Exports

szFile

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 931B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ