NEAS[.]5511e3912880101ab20639c3cf71fb70[.]exe | Triage

Sharing

General

Target

NEAS.5511e3912880101ab20639c3cf71fb70.exe
Size

418KB
MD5

5511e3912880101ab20639c3cf71fb70
SHA1

8e9c4affcb3d6d55c39d3071c382a2687b93d51d
SHA256

66d096de33f7bddb54d7eeb4e629fe158aca9e767dbf632c0e51200f9bd02b89
SHA512

51aad802c652210e00ac38f040cb466a6a36e861d1f453e7a6822b1d7dc33696b67bc0cd33668bd4bc99501b32e8f69b81adc2e594ed019f688a87dca4a75e9b
SSDEEP

6144:co4eBzhCpjRh219mKYUIsvZ2miRmmWHTNCtom3RRh2Xo79Y8fgkz8LUeKAG72iet:lPuNwIyvEmV4fvBfLz8Kl72kmNz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.5511e3912880101ab20639c3cf71fb70.exe

Files

NEAS.5511e3912880101ab20639c3cf71fb70.exe
.dll windows:4 windows x86

7602608f0c7cf927a6dbf3d432bfff49

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

wsock32

inet_addr

mfc42

ord2976

msvcrt

free

user32

MoveWindow

gdi32

StretchBlt

shell32

SHBrowseForFolderA

comctl32

_TrackMouseEvent

ole32

CreateStreamOnHGlobal

olepro32

ord251

msvcp60

?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z

Exports

Exports

Config_GetRect
Config_Init
Config_MoveWindow
Config_Refush
Config_SetCallback
Config_UnInit
Config_languageInit

Sections

.text
Size: 400KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE