NEAS[.]4a97cbdf47c5cd34c57bba51e2ec7a90[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.4a97cbdf47c5cd34c57bba51e2ec7a90.exe
Size

30KB
MD5

4a97cbdf47c5cd34c57bba51e2ec7a90
SHA1

c4b868cae464c31f1103da15e8826d81dd22a0f3
SHA256

3cddc78e162495a9baf357b1799518e3a9979c3cc7c76f33d4ef7698ea17aeb8
SHA512

e8ee3bceb4c1faa52a9f6098e5d424c8482b4713bd08a2a14d3fa65717e96bbda0d8202d72dad8fcfe7ceb9ae68f5e850082744dc88b774d88ab684a7dfe6a1e
SSDEEP

768:KSxfuSGx2RDeutdgI2MyzNORQtOflIwoHNV2XBFV72B4lA7ZsiZ+vsnzLMmjs/TS:Kyu8DeutdgI2MyzNORQtOflIwoHNV2Xg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.4a97cbdf47c5cd34c57bba51e2ec7a90.exe

Files

NEAS.4a97cbdf47c5cd34c57bba51e2ec7a90.exe
.exe windows:5 windows x86

688ad82d47fe4314040aa0041646c921

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdiplus

GdipCloneImage
GdiplusStartup
GdipCreateFromHDC
GdipBitmapGetPixel
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipDeleteGraphics
GdipFree
GdipAlloc

kernel32

LoadLibraryA
HeapAlloc
lstrcatW
OutputDebugStringW
LoadLibraryW
GetCurrentProcess
FindResourceW
LoadResource
SizeofResource
LockResource
VirtualAlloc
VirtualFree
FreeLibrary
GetProcAddress
GetProcessHeap

user32

ReleaseDC
BeginPaint
GetDesktopWindow
EndPaint
wvsprintfW

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 246B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ