NEAS[.]d9d0559308a74d9105fe96a870f167c0[.]exe | Triage

Sharing

General

Target

NEAS.d9d0559308a74d9105fe96a870f167c0.exe
Size

444KB
MD5

d9d0559308a74d9105fe96a870f167c0
SHA1

862c630bc30c9fc79e003ae2731240b40db43276
SHA256

1b74ac892ac6bd6527ef58140c3b06ed1f7d99c6b0f8527e0a2587b26f7fbe11
SHA512

ccb09a07e2837bff2f4189263b7e2e9c39c8eb1992fa58289bce7e604e47c35ac19b735136fab970f5e29285ab71e5e92e95f9fe65bf9964e542c2abefb86a58
SSDEEP

12288:GXDIpjCZJ/07N0fGTdrQ6gtVUcBFYPwxMgZDH6EuPK3e:CUpjCD/092ayuwxrde

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.d9d0559308a74d9105fe96a870f167c0.exe

Files

NEAS.d9d0559308a74d9105fe96a870f167c0.exe
.exe windows:4 windows x86

ae0a5112fe1176f4e5f6e1bc95e4c209

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA

kernel32

FreeLibrary
lstrcatA
GetModuleFileNameA
ExitProcess
LoadLibraryA
GetProcAddress
lstrlenA

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

Sections

.text
Size: 1024B - Virtual size: 556B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 404B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 431KB - Virtual size: 431KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ