NEAS[.]5978a9249b1621b1dad6d8338e786c40[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.5978a9249b1621b1dad6d8338e786c40.exe
Size

1.6MB
MD5

5978a9249b1621b1dad6d8338e786c40
SHA1

b71ccb925b52fa536941e276a444ef6a60f8d5b3
SHA256

ca803b2f37e5dee04eaabe784ee6fcf7c56629822a96d5e7b1c54c67c48eb7b7
SHA512

1b8d41795ff6d694aeea5662a315b3f3e2677fa7586f383b6281494eb4cdbda6fd4341295c2061363aa408559908af867a636657e6a4689d25dae26fcfe42207
SSDEEP

49152:XxOqdxmwGSv1Dof0Zzqbiq49HeHzIQqgiht+0FKGgyI:hOqPhDos6j49szIDhtN0GgyI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.5978a9249b1621b1dad6d8338e786c40.exe

Files

NEAS.5978a9249b1621b1dad6d8338e786c40.exe
.exe windows:5 windows x86

4710e694cbc904bbde58b1960e1a3f6b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
GetTickCount
GetModuleFileNameW
SetEnvironmentVariableW
GetCurrentProcessId
OpenFileMappingW
GetLastError
MapViewOfFile
CloseHandle
CreateFileW
CreateFileMappingW
UnmapViewOfFile
GetFileInformationByHandle
VirtualAlloc
VirtualFree
GetModuleHandleA
GetFileSizeEx
GetProcAddress
LoadLibraryW

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xcpad
Size: - Virtual size: 96KB

.idata
Size: 1024B - Virtual size: 692B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ