NEAS[.]f6d233c2e87ef597dea34827f5544d80[.]exe | Triage

Sharing

General

Target

NEAS.f6d233c2e87ef597dea34827f5544d80.exe
Size

840KB
MD5

f6d233c2e87ef597dea34827f5544d80
SHA1

62cb91eae57d41ff0d3987016ff426a347fe3281
SHA256

dab1acf196ba9be0a51c167508e7a5c9de52d7d06845103aeb0dc26247643521
SHA512

e3cbbc05ad9c92f72ae05840dbc62c830192b75f2dde3bd0603e73fb0ebec8e39325fe642ddef5a09c0fc8047eeb51f9e0aaf74140021f6a9f5285025335ddc4
SSDEEP

24576:WYDJPU7Swq7ywT/8ers5aOf+fy3Gb8dhZsyFb:WPj9wTh+aOGKPb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.f6d233c2e87ef597dea34827f5544d80.exe

Files

NEAS.f6d233c2e87ef597dea34827f5544d80.exe
.exe windows:4 windows x86

4855da6edbc97ba76eec4c5f6bc1bd9b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
_acmdln
__set_app_type
_except_handler3
_controlfp
exit
_XcptFilter
_exit
_stricmp
strncmp
_strlwr
strcmp
fmod
memcpy
strlen
__p__fmode
strcpy
??3@YAXPAX@Z
??2@YAPAXI@Z

kernel32

VirtualQuery
VirtualProtect
SetFilePointer
CreateFileA
ReadFile
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleFileNameA
GetStartupInfoA

user32

wsprintfA
MessageBoxA

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 972B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 640B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tData
Size: 830KB - Virtual size: 5.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE