NEAS[.]e190476c5e4b7ead9ffc787168575530[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.e190476c5e4b7ead9ffc787168575530.exe
Size

144KB
MD5

e190476c5e4b7ead9ffc787168575530
SHA1

a4cdd167993ee47b1f912bf8074f3305d86433dc
SHA256

1505147e545aeb9013f60ec6043f254bbe41975cd817919266b4a642e68c1cf8
SHA512

69d605ba0fab0088ce87ef01009cf570fabb9560ac0d77f8b059f3d590ee99782fb99236e3e582ea5e08d532e4b304ecb17041e621e46ce1f8ea126d04801d74
SSDEEP

3072:NRn6GPa7aXwQNfRjrVOEf7Y4Qpyok9WUZxiv7z:N56Gfr9tMEfp9RZov7z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.e190476c5e4b7ead9ffc787168575530.exe

Files

NEAS.e190476c5e4b7ead9ffc787168575530.exe
.exe windows:4 windows x86

ec5d697360306ce025888e1386f14089

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThread
GetComputerNameA
CreateMutexA
GetVersionExA
GetProcAddress
LoadLibraryA
GetCurrentDirectoryA
VirtualProtect
LockResource
LoadResource
GetCurrentProcessId
GetWindowsDirectoryA
LocalFree
GetCurrentProcess
ExitProcess
GetSystemDirectoryA
VirtualAlloc
GetCurrentThreadId
LocalAlloc
CreateEventA
FindResourceA
GetStdHandle

advapi32

GetUserNameA

user32

GetForegroundWindow
GetActiveWindow
GetSystemMetrics

msvcrt

memcpy
memset
wcslen
wcsncpy

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 14B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ