NEAS[.]c4c9c4d8421ccf6aeafb9a5f8063d160[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.c4c9c4d8421ccf6aeafb9a5f8063d160.exe
Size

325KB
MD5

c4c9c4d8421ccf6aeafb9a5f8063d160
SHA1

8af0eedd785ffcbf445c8a930a1138498922b5d4
SHA256

222aa5cd461c89366ce102c2cecedb84e0f66fd422223c0ab23fd8129243f432
SHA512

d92af6ffcd3b32aea4b9cf0af9dc2aa81984f2b75c24878a5238cf468b30ea5dd5ecbf0048ac74abe3aef03847382c5477b97891e6e13af697d4d5350a7d7303
SSDEEP

6144:Tgpd5NG3XXnRI2RZfdM5rkVYIWNJnXyEtBfCvoK8CUmt6CAWctDpv:TgP/IXRIGdMNkiIEJnXWzbUVtWctDpv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.c4c9c4d8421ccf6aeafb9a5f8063d160.exe

Files

NEAS.c4c9c4d8421ccf6aeafb9a5f8063d160.exe
.exe windows:4 windows x86

cbea90da7f463157ac55686475029e73

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalFree
GetExitCodeProcess
GetTickCount
SetLastError
CreateThread
GetDiskFreeSpaceW
CreateFileA
GetModuleHandleA
GetFileAttributesA
LoadLibraryW
FindAtomA
ResetEvent
HeapCreate
GetComputerNameA
TlsGetValue
GetSystemTime
SetEvent
SuspendThread
GetCommandLineW
CloseHandle

advapi32

RegDeleteKeyA
RegCloseKey
IsTokenRestricted
RegEnumKeyExA
CredFree
CloseEventLog
RegQueryValueA
GetFileSecurityA
GetUserNameW
RegCreateKeyExA
CreateServiceW
RegEnumValueA
GetLengthSid

cryptui

WizardFree
LocalEnroll
CryptUIDlgCertMgr
CryptUIDlgSelectCA
CryptUIDlgSelectStoreA

powercfg.cpl

CPlApplet

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 428KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 315KB - Virtual size: 314KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ