NEAS[.]fd5f6199501f77994bea5f6eecea66f0[.]exe | Triage

Sharing

General

Target

NEAS.fd5f6199501f77994bea5f6eecea66f0.exe
Size

27KB
MD5

fd5f6199501f77994bea5f6eecea66f0
SHA1

9848f45dac3ab0082cea2b1c0d6a66f45ef0ef48
SHA256

1f2d10cbca10aef9a1f562625ff081f60db17c630a8db250df1d18118de70ce5
SHA512

1608328b7068994bd297af3dcbce8d8b9bc37e6d483bb98080f6648f3c4bf1af90ae88f64a108858a15fbac824065edb6e232fcc0022d985634191bca6120292
SSDEEP

768:Z8xwESspsdGeVM1xDA9mAgEo1CkJpB9Ov:Z8Ovz0Xa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.fd5f6199501f77994bea5f6eecea66f0.exe

Files

NEAS.fd5f6199501f77994bea5f6eecea66f0.exe
.exe windows:4 windows x86

603db2aa0c2d078814d1d2c1fb1c1834

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CallWindowProcA

kernel32

GetProcAddress
LoadResource
SizeofResource
LoadLibraryA
FreeLibrary
LockResource
ExitProcess

msvbvm60

ord696
MethCallEngine
ord518
ord520
ord522
ord631
ord524
ord632
ord526
EVENT_SINK_AddRef
ord528
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord607
ord717
ProcCallEngine
ord537
ord644
ord100
ord617
ord619

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ