NEAS[.]aaa490cd1cbe4a5e5e7c2cf1614d2ad0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.aaa490cd1cbe4a5e5e7c2cf1614d2ad0.exe
Size

504KB
MD5

aaa490cd1cbe4a5e5e7c2cf1614d2ad0
SHA1

6be06ca7143a886777cf80cf3da47378d14f377d
SHA256

eac7e7259bba4a24d7302f0b1523bdd09d29cd71e43672991d86d735e945714d
SHA512

4a9ec11c69e3d9ae9b9cea684a82e843a0867091bd02aef671269c68ac01d7f1376db28a8aed0f5645426290e0576cb324c5142bb2e98a5ca356bfccced89d2f
SSDEEP

12288:fVNNaF2vPFTEMJoZdNuJATCyARbSeEBBQGvaimOidwsaY14MqBgsFD:fVNN5v9TTJYNuJATChp/1mSOidwRYO5D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.aaa490cd1cbe4a5e5e7c2cf1614d2ad0.exe

Files

NEAS.aaa490cd1cbe4a5e5e7c2cf1614d2ad0.exe
.exe windows:4 windows x86

7c2116af86cf5b29bc6a7e0377601029

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

lz32

LZInit
LZClose
LZCopy

comctl32

ord17

kernel32

HeapAlloc
GetProcessHeap
GetLastError
ExitProcess
GetThreadContext
CreateFileA
SetThreadContext
SetFilePointer
lstrlenA
lstrcpynA
SetErrorMode
FreeLibrary
GetCurrentProcess
GlobalLock
WaitForSingleObject
WriteFile
GlobalAlloc
Sleep
CreateProcessA
ReadFile
GlobalUnlock
FlushInstructionCache
GetCommandLineA
GetProcAddress
RemoveDirectoryA
VirtualProtectEx
GlobalFree
GetTempFileNameA
LoadLibraryA
MoveFileA
GetModuleFileNameA
DuplicateHandle
CloseHandle
GetTempPathA
WriteProcessMemory
ResumeThread
DeleteFileA
lstrcpyA
GetModuleHandleA
GetStartupInfoA

user32

wsprintfA
MessageBoxA

Sections

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ