NEAS[.]417769a144751320ae15f08179093670[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.417769a144751320ae15f08179093670.exe
Size

403KB
MD5

417769a144751320ae15f08179093670
SHA1

a10161fbafc24c0597eb0e2074a60319e08aebfb
SHA256

af52825fca65b493ecf8d077a0412f6d60ea3117830183043c0f0485f148bb3a
SHA512

ec5ac9e381268bf23620280fcfff1f663cb6333ac5cdc7e544e30515cc9ff5bac80d0f4cb520ab67a68023a88804a18044ba95dd8ca64a09389fe7dce12c7d9b
SSDEEP

3072:iLtkcR/5ks/ttjJDCzFII5ar3Cbs5Um4rqrTHqDFT:QXbjCFIIMSw5UpkaF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.417769a144751320ae15f08179093670.exe

Files

NEAS.417769a144751320ae15f08179093670.exe
.exe windows:4 windows x86

720c886028db8a7751d3b002098f0b27

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

version

VerQueryValueA

urlmon

UrlMkGetSessionOption

shell32

SHGetSpecialFolderLocation

wsock32

WSACleanup

ntdll

NtQueryInformationProcess

rpcrt4

UuidCreateSequential

Sections

CODE
Size: 118KB - Virtual size: 360KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE