NEAS[.]e3b65f490e6c5d463458d9bda288a5b0[.]exe

General

Target

NEAS.e3b65f490e6c5d463458d9bda288a5b0.exe
Size

153KB
MD5

e3b65f490e6c5d463458d9bda288a5b0
SHA1

7bb43d329b39e8884b24d8ad95d9838973389446
SHA256

5a961f487a4bd15fad7f758ba3cbd86191cdb8a826e76984fdc21241899efdaa
SHA512

6655ca1ad8889f4dea582f6848962945cf6a27a816bf46f3361b74deb7ba055ca40aba44ed42e9f409acf00353bdf3159d460c926c3e68cae451a0d95c4120d5
SSDEEP

3072:62n7CoWd07esc3BUEgiahMdnZylqQFB07+naL:fCoWd0kSEgiiAZc1B07aaL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.e3b65f490e6c5d463458d9bda288a5b0.exe

Files

NEAS.e3b65f490e6c5d463458d9bda288a5b0.exe
.exe windows:1 windows x86

21630359c9d0deaa875c478565a8091b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CryptBinaryToStringA

user32

GetCursorPos
GetWindow
LoadStringA

kernel32

CloseHandle
CreateFileA
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
FreeLibrary
GetCommandLineA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetLocaleInfoA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
GetVersionExA
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
LeaveCriticalSection
LoadLibraryA
QueryPerformanceCounter
SetUnhandledExceptionFilter
TerminateProcess
UnhandledExceptionFilter
VirtualProtect
lstrlenA
LocalFree

advapi32

GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
UnregisterTraceGuids
RegisterTraceGuidsW

ole32

CoUninitialize

Sections

AUTO
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DGROUP
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.htext
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

21630359c9d0deaa875c478565a8091b

Headers

File Characteristics

Imports

crypt32

user32

kernel32

advapi32

ole32

Sections

AUTO Size: 4KB - Virtual size: 3KB

DGROUP Size: 122KB - Virtual size: 121KB

.idata Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 184B

.htext Size: 8KB - Virtual size: 8KB

AUTO
Size: 4KB - Virtual size: 3KB

DGROUP
Size: 122KB - Virtual size: 121KB

.idata
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 184B

.htext
Size: 8KB - Virtual size: 8KB