NEAS[.]eb91187957d12ac021b4e19f3eaed700[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.eb91187957d12ac021b4e19f3eaed700.exe
Size

294KB
MD5

eb91187957d12ac021b4e19f3eaed700
SHA1

e994e2d3260da10a1d86fb0e032dae1d6daac8bc
SHA256

7d8bd8e36e21489e94b82d20d786431091b9efa24192c612d4797bf5a2c27755
SHA512

74d1c0e92a839912ee9d6137c439b3fd9c125b42689cb402100624a8da968faaafce8ecdd35e8509d5cbf9b4f87ca45c28e1b417c3d0ab94158fe62a751a3c61
SSDEEP

6144:MfRuSxFMY2uYmVAvivBHDpr88CtFO4y3vVkzjIfO5L+AXbh:MgSxFMiYmVAviv5Z8nt1UkAI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.eb91187957d12ac021b4e19f3eaed700.exe

Files

NEAS.eb91187957d12ac021b4e19f3eaed700.exe
.exe windows:1 windows x86

91b9d16df63fda33e0171a72162c99e4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CryptBinaryToStringW

kernel32

GetLastError
GetProcAddress
LoadLibraryA
RtlUnwind
VirtualProtect
GetModuleHandleW

user32

GetWindow

shlwapi

PathAppendA
PathAppendW

crtdll

__GetMainArgs
exit
raise
signal

ulib

?Strcat@WSTRING@@QAEEPBV1@@Z
??0DSTRING@@QAE@XZ
??0STRING_ARGUMENT@@QAE@XZ
??0ARRAY@@QAE@XZ
??0ARGUMENT_LEXEMIZER@@QAE@XZ
??0FLAG_ARGUMENT@@QAE@XZ
?Initialize@ARRAY@@QAEEKK@Z
?Initialize@ARGUMENT_LEXEMIZER@@QAEEPAVARRAY@@@Z
?SetCaseSensitive@ARGUMENT_LEXEMIZER@@QAEXE@Z
?PrepareToParse@ARGUMENT_LEXEMIZER@@QAEEPAVWSTRING@@@Z

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 175KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 292B - Virtual size: 292B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE