NEAS[.]c9b79e3ee2894479cad82c7547c61e10[.]exe | Triage

Sharing

General

Target

NEAS.c9b79e3ee2894479cad82c7547c61e10.exe
Size

139KB
MD5

c9b79e3ee2894479cad82c7547c61e10
SHA1

5eeaacab4999e850dcbebb22b082145d7f44ef33
SHA256

78b51cde77394b83adfac451e0ae076fe21c83654b970538efd0328d2f9cc519
SHA512

c4ea89d96989b59e3a1e1c8ea63fedc7934f3a61d713cee3aa6c88b5b274dd8f926f5592751aed4d5b9d34e4bd546cb9bed5eb209d5ed1d4e190739579a08b82
SSDEEP

3072:9hlkUC7wGnLduIVs/wGD0WQubZ0Bbm7HWKlrreiBDc4:9DkIGn8IVODChBSbWKl1Dc4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.c9b79e3ee2894479cad82c7547c61e10.exe

Files

NEAS.c9b79e3ee2894479cad82c7547c61e10.exe
.exe windows:1 windows x86

214a4fdc45b1e49eaeb17c7ca1b86e49

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
GetModuleHandleA
GetProcAddress
GetTempPathA
LoadLibraryA
RtlUnwind
CreateFileA
CreateFileMappingA
VirtualProtect
lstrcpyA
CloseHandle
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoA
lstrlenA
GetVersionExA
GetSystemDirectoryA
CreateEventA
OpenProcess

crtdll

__GetMainArgs
exit
raise
signal

psapi

EnumProcesses

advapi32

RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegCloseKey
OpenProcessToken
FreeSid
AllocateAndInitializeSid

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 125KB - Virtual size: 364KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 384B - Virtual size: 384B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ