NEAS[.]2b2ad0f6a1b5196bb333c33e465a3e50[.]exe | Triage

Sharing

General

Target

NEAS.2b2ad0f6a1b5196bb333c33e465a3e50.exe
Size

144KB
MD5

2b2ad0f6a1b5196bb333c33e465a3e50
SHA1

1a8281cf60874dbe8732cf7b85c088b18176e16d
SHA256

84c03321c8212d6d8f7465c66f1bf54288081101bfd3968dda5834d20ad208aa
SHA512

12378150a5461d093dcaacd9645570db1f7b14c515bc07d18ef2ba26c4abc016e98a1f7bd58fe5143785e7fa59af793be4dfd7791860e1fd1b25ec7c0fc32335
SSDEEP

3072:AGMohJ718OEiNBP718rBrBQyizKgtFJlsmi3:LhJ58OdV7CFiyiWC6mi3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.2b2ad0f6a1b5196bb333c33e465a3e50.exe

Files

NEAS.2b2ad0f6a1b5196bb333c33e465a3e50.exe
.exe windows:1 windows x86

adf801abd4677429ccec4447083cae59

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesExA
GetLastError
GetModuleHandleA
GetProcAddress
CloseHandle
GetTempPathA
GetTickCount
RtlUnwind
SetLastError
GetCommandLineA
GetStdHandle
MultiByteToWideChar
GetFileType
LoadLibraryA
FreeLibrary
LocalFree
FindFirstFileA
LocalAlloc
WriteConsoleA
FormatMessageA
FindNextFileA
GetFileAttributesA
VerifyVersionInfoW

crtdll

__GetMainArgs
exit
raise
signal

ntdll

VerSetConditionMask
wcsncpy
wcschr
wcslen
memmove
_wcslwr
wcscmp
wcscpy
_wcsnicmp
wcscat
_ultoa
wcstoul
wcstol

user32

LoadStringA

winsta

WinStationOpenServerW

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 129KB - Virtual size: 364KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 434B - Virtual size: 434B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ