NEAS[.]21ddf21a7473f2efc6ad52c5c27dc890[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.21ddf21a7473f2efc6ad52c5c27dc890.exe
Size

5KB
MD5

21ddf21a7473f2efc6ad52c5c27dc890
SHA1

fb10f7c2025ea5dc38947168cb2795b80ff7fdd6
SHA256

540352bd6b9238d29c43d7f1f574940e81c564f0b7a4a644c949db74eb25e06f
SHA512

402d895c21886e2d1d56f0e0eaed89cec5b67b7163d0fbc9ad83dbe813ada93f729e460f71d2fecca19632e2ce1afa491715c39f65f147feebc0b88943e73b86
SSDEEP

96:gtH9XTeIG3FJVnBwDVpkOQ9cTrtE3Hlor:K9XiIKFrC5pkOQ95Vor

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.21ddf21a7473f2efc6ad52c5c27dc890.exe

Files

NEAS.21ddf21a7473f2efc6ad52c5c27dc890.exe
.exe windows:4 windows x64

dc11dc13fd8d90268bf530d517a7df27

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

LocalAlloc
GetSystemTime
Sleep
ExpandEnvironmentStringsA

msvcrt

memmove
printf
system
_vsnprintf
__set_app_type
_controlfp
__argc
__argv
_environ
__getmainargs
exit

urlmon

URLDownloadToFileA

snmpapi

SnmpUtilOctetsCpy
SnmpUtilOidCpy
SnmpUtilVarBindCpy
SnmpUtilOidFree
SnmpUtilPrintAsnAny
SnmpUtilMemReAlloc
SnmpSvcGetUptime
SnmpUtilVarBindFree
SnmpUtilOidToA
SnmpUtilOctetsNCmp

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ