NEAS[.]f697803f0324a47baa046cf6b0ad4080[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.f697803f0324a47baa046cf6b0ad4080.exe
Size

39KB
MD5

f697803f0324a47baa046cf6b0ad4080
SHA1

0c0b19d2206a7a14739a9f012fb0cbfd5432a27f
SHA256

9bc07d62ffac723a6bec7110528f3cc4ba9bd4cb6fabadb6d2d12f2b5a184c78
SHA512

365e4c34a3c1d623cf37971f2ef720e3531d1ac8bdd7c506f1698f3d98bf7f8591de7c7345d4234d7e78899cee83cb9a81577d7dc96e774cb0e119b184cd6779
SSDEEP

768:/zSJcDSWD6z3afvJc0cFOF+Mj0prJyokyWURPF8NQvUB8X5:/zLDSWmz3QJhcFOF+Mj0prJyokyWURPz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.f697803f0324a47baa046cf6b0ad4080.exe

Files

NEAS.f697803f0324a47baa046cf6b0ad4080.exe
.exe windows:4 windows x86

2dd6c80642b2098b8e4d0e817889d29d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

LoadStringA
LoadCursorA
LoadIconA
RegisterClassExA
GetMessageA
ShowWindow
CreateWindowExA
DefWindowProcA
PostMessageA
SendMessageA
TranslateMessage
DispatchMessageA
BeginPaint
EndPaint
PostQuitMessage
SetFocus
DestroyWindow
UpdateWindow

kernel32

lstrlenA
GetModuleHandleA
GetStartupInfoA
LoadLibraryA
WriteProcessMemory
CreateDirectoryA

gdi32

TextOutA

wtsapi32

WTSEnumerateProcessesA
WTSLogoffSession
WTSQuerySessionInformationA
WTSWaitSystemEvent

crtdll

_initterm
_exit
_local_unwind2
_global_unwind2
_fmode_dll
_commode_dll
__GetMainArgs
_XcptFilter
_acmdln_dll
exit
??2@YAPAXI@Z

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ