NEAS[.]99f164afbd9b1f82ee20bd865a567d50[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.99f164afbd9b1f82ee20bd865a567d50.exe
Size

4.1MB
MD5

99f164afbd9b1f82ee20bd865a567d50
SHA1

09ab54f4408b355b93b179afc7b82147b986cd10
SHA256

6cdac25ec19b1adb722673743c1dfe6ff7390ff551e1ff6183a85dbccc5c9d8e
SHA512

49d3eca1547f2393306f945a01e989ac439f7ec1102c1e1f2ff98baa6f51bff659553c89708686ca9e292c601cfd72f038df384e135eb7a38b6c026a7f58a22c
SSDEEP

3072:TU/f+GhavlAOI3uOUE4nVP/5d2m/SLt6gjoTbiI:T6WGhcN1O34nx8ZLjtI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.99f164afbd9b1f82ee20bd865a567d50.exe

Files

NEAS.99f164afbd9b1f82ee20bd865a567d50.exe
.exe windows:4 windows x86

1c16a98f1cb57faf4af8d5041671605b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

utl60

ord28
ord55
ord54
ord29

upd60

ord27
ord49
ord48
ord56
ord44
ord43

core40

ord199

user32

MessageBoxA

kernel32

GetModuleHandleA
GetStartupInfoA
GlobalAlloc
GetModuleFileNameA
GlobalUnlock
GlobalFree
GlobalLock

msvcrt

sprintf
_XcptFilter
memset
strcpy
strlen
_exit
__p__commode
_adjust_fdiv
_controlfp
_except_handler3
strcmp
__set_app_type
exit
__p__fmode
_initterm
__getmainargs
__p__acmdln
__setusermatherr

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE