NEAS[.]41b1023ebd4b084980e215ed35a82ef0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.41b1023ebd4b084980e215ed35a82ef0.exe
Size

5KB
MD5

41b1023ebd4b084980e215ed35a82ef0
SHA1

155833ccc669b114d3fd3dc4278ed8bbf474285b
SHA256

e4ae10d0b5330d9edc1ba30abe640677b78f341317f17395943bf9366444f150
SHA512

d850e597653701ae430dee9c0b5b5ee4c77dfa2836334160d019c5640c9bf10192f3f1cca35e8659aec9ba25250bd55f7c209e71993a428f4afbf4e6893b9816
SSDEEP

96:CXtHFXoHZr8Pfnvvnlzq31oO49cTrG84pForZ0:ChFX0d8n3nlu3CO49porZ0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.41b1023ebd4b084980e215ed35a82ef0.exe

Files

NEAS.41b1023ebd4b084980e215ed35a82ef0.exe
.exe windows:4 windows x64

4e684196cce8859049cc52c2d3306157

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

LocalAlloc
GetSystemTime
Sleep
ExpandEnvironmentStringsA

msvcrt

memmove
printf
system
_vsnprintf
__set_app_type
_controlfp
__argc
__argv
_environ
__getmainargs
exit

urlmon

URLDownloadToFileA

snmpapi

SnmpUtilOidCpy
SnmpUtilVarBindCpy
SnmpUtilOidFree
SnmpUtilPrintAsnAny
SnmpUtilVarBindFree
SnmpUtilOidNCmp
SnmpUtilOctetsNCmp

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ