NEAS[.]48784390aa060d37c6c8d6150997e400[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.48784390aa060d37c6c8d6150997e400.exe
Size

6KB
MD5

48784390aa060d37c6c8d6150997e400
SHA1

6414b62d856bf97f6f95ff22f6af2a734b7f5ca4
SHA256

906dac0aa0c149f78b6bb4f60bb32a83d7dd7bd9ca076f487b54e7d7605df504
SHA512

b7dc7825e6ef900724c86de6b55559ac3619ba176c5b832f56a5e99f025aab1a20eaa38d0437f235d4f2ed68feec76edd3c5f7821aafa11bfb372c5f7c8d2a3b
SSDEEP

96:eZtHOXjqGlXtC+glvClJ5N2N/yfddrTr+C1ForVQ:kOXPxtC+CC3zs/yfmqor

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.48784390aa060d37c6c8d6150997e400.exe

Files

NEAS.48784390aa060d37c6c8d6150997e400.exe
.exe windows:4 windows x64

a8a423c190c11a18c3cdaa34b27fd2c1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

LocalAlloc
GetSystemTime
Sleep
ExpandEnvironmentStringsA

msvcrt

memmove
printf
system
_vsnprintf
__set_app_type
_controlfp
__argc
__argv
_environ
__getmainargs
exit

urlmon

URLDownloadToFileA

snmpapi

SnmpUtilOidCpy
SnmpUtilOidAppend
SnmpUtilVarBindCpy
SnmpUtilPrintOid
SnmpUtilPrintAsnAny
SnmpUtilMemFree
SnmpUtilVarBindFree
SnmpUtilOidNCmp
SnmpUtilOidToA
SnmpUtilIdsToA
SnmpUtilOctetsNCmp

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ