NEAS[.]e993df04a1d95d42d075b779204ce150[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.e993df04a1d95d42d075b779204ce150.exe
Size

209KB
MD5

e993df04a1d95d42d075b779204ce150
SHA1

eab99e827da304204781f4f5f4a2968247740e1d
SHA256

1c8a1c36020285d34cb16184a3e1fdc09088f2617afed155366aef00cd934c7f
SHA512

c565e9611ecec0f368af698e1afe7a1ce5e5124f59390bd23e3eea44caf441071fffe37718f2edb53ba6a51ac416be77cd8681020db33264853ac3cc1223d0e1
SSDEEP

3072:pZvA3B0NqgMm2XWoPAOpFr5Na4JnqYXGzUe/jXrTlyNv744Vv5bHX01CQQ257wfy:XoyXMykAOp04Jy/rrJyNjJ257yirG50

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.e993df04a1d95d42d075b779204ce150.exe

Files

NEAS.e993df04a1d95d42d075b779204ce150.exe
.exe windows:5 windows x86

328a5ca36033026afb801bf4b225e64b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
LoadLibraryW
lstrcmpA
GetTickCount
GetVolumeInformationA
FindResourceA
CloseHandle
GetProcessHeap
GetCurrentProcess
SetUnhandledExceptionFilter
GetCurrentProcessId
lstrcpyA
GetLocaleInfoA
QueryPerformanceCounter
HeapFree
WideCharToMultiByte
CreateFileA
GetOEMCP
IsValidLocale
MultiByteToWideChar
SystemTimeToFileTime
GetSystemTimeAsFileTime
GetLocalTime
SetLastError
lstrlenA

scecli

SceAddToNameStatusList
SceCloseProfile
SceAddToObjectList
SceAnalyzeSystem
SceBrowseDatabaseTable
SceAppendSecurityProfileInfo

schannel

QuerySecurityPackageInfoW
InitializeSecurityContextW
QueryContextAttributesW
QueryContextAttributesA
QuerySecurityPackageInfoA

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegQueryValueExA

Sections

.text
Size: 143KB - Virtual size: 142KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.jdata
Size: 5KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rcrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ