NEAS[.]8c706d98571185147e4eee2660a3ef20[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.8c706d98571185147e4eee2660a3ef20.exe
Size

3.8MB
MD5

8c706d98571185147e4eee2660a3ef20
SHA1

ece149622a34fbe419b3cae498bc7bd35b45f4f7
SHA256

03aadce09a11392a22dfeaa65f095be4c73180e5f04c03f24b9dc492c28d0d18
SHA512

5c1e9b03039adf0ecb65532bd902b6b75c8a79b9cf86868c2aae7198349342e93919ccefc746b0a00527c26f460ce20f2274debd3dfd3f49510eaa16b49aed89
SSDEEP

98304:SM3gotpShiA3TYHPXqfAnffq3TLzULFYgNeLyhsupK:SM3fCiA3TYPlfCg5NUyh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.8c706d98571185147e4eee2660a3ef20.exe

Files

NEAS.8c706d98571185147e4eee2660a3ef20.exe
.exe windows:4 windows x86

d19b36d68969eadd28317ee292f2ceab

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

mpr

WNetGetConnectionA

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

CoCreateGuid

comctl32

ImageList_SetIconSize

shell32

ShellExecuteA

wininet

InternetReadFile

comdlg32

GetOpenFileNameA

wsock32

WSACleanup

Sections

CODE
Size: 3.7MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE