NEAS[.]48663e601b0d506f85de6f0033a457b0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.48663e601b0d506f85de6f0033a457b0.exe
Size

5KB
MD5

48663e601b0d506f85de6f0033a457b0
SHA1

cd5d99e61965b1378c456efc9db9cd0cad0c2313
SHA256

0d4b24fb09cfb3717e346b9a094a9f68a219de9e4df65ecca4bd39c618c2f2fe
SHA512

f8231a11526aa9e7bec2d501a85f8af78a82020915adf2612d660f2c327b17890b7f43a36ea1a1f89b498f37869ecdcf0ad1fdc99049120414678e0aab865b7c
SSDEEP

96:bhtHYXxqefgqQaE4k2+OBWTr5pY4t5or:bLYXyq/z+OaJor

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.48663e601b0d506f85de6f0033a457b0.exe

Files

NEAS.48663e601b0d506f85de6f0033a457b0.exe
.exe windows:4 windows x64

0761185187130a686268ed3527ed0ef4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

LocalAlloc
GetSystemTime
Sleep
ExpandEnvironmentStringsA

msvcrt

memmove
printf
system
_vsnprintf
__set_app_type
_controlfp
__argc
__argv
_environ
__getmainargs
exit

urlmon

URLDownloadToFileA

snmpapi

SnmpUtilOidAppend
SnmpUtilOidFree
SnmpUtilPrintOid
SnmpUtilPrintAsnAny
SnmpUtilMemReAlloc
SnmpSvcGetUptime
SnmpUtilVarBindFree

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ