NEAS[.]8ebfa18588c120ce20a03580c8bbd070[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.8ebfa18588c120ce20a03580c8bbd070.exe
Size

146KB
MD5

8ebfa18588c120ce20a03580c8bbd070
SHA1

a5873cfb115d51c86820fdd336b47c30352cb738
SHA256

1ae54c8e1e679cc6664abf5a86c0bc828bf87f9fea3783401786c91422313ea2
SHA512

52c710f7bbdc0d05d21016ff69fb5e47ebb89c2474b997c3d1092d7d1ee065442c7be9e2e740df1a85817062b902147452259acb26e89bd2cd01bb6486fdf009
SSDEEP

3072:N/RJp9x9lqW1oEr0hsLZSHI4GybIXxlrxg4/hmWo95M9PjQS83V:NZ1x9lMEACYI4fE7r9hlgpS4V

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.8ebfa18588c120ce20a03580c8bbd070.exe

Files

NEAS.8ebfa18588c120ce20a03580c8bbd070.exe
.exe windows:1 windows x86

ff17e94c9d9774363ae48232954c7538

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

iphlpapi

GetAdaptersInfo

kernel32

GetModuleHandleA
GetProcAddress
CloseHandle
GetTickCount
RtlUnwind
EnterCriticalSection
SetLastError
GetCurrentThreadId
GetCurrentProcess
UnhandledExceptionFilter
GetStartupInfoA
GetLastError
GetCommandLineA
lstrlenA
GetVersionExA
GetModuleFileNameA
LCMapStringA
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
QueryPerformanceCounter

crtdll

__GetMainArgs
exit
raise
signal

advapi32

RegOpenKeyExA
RegQueryValueExA
AddAccessAllowedAce
RegSetValueExA
RegCreateKeyExA
RegCloseKey

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 344B - Virtual size: 344B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ