NEAS[.]691581e3e9a61128d5d0947c4241ed70[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.691581e3e9a61128d5d0947c4241ed70.exe
Size

2.0MB
MD5

691581e3e9a61128d5d0947c4241ed70
SHA1

c140b76893e0fb9d238eb8bf656474c2a426b5bf
SHA256

26fa846f6cb529a5131a611d5f093ee4df3a5b41c0ab01f270e84aefed91b173
SHA512

fc44e9c39a1276312a3df15a83d635feb071900eaa58fe2f8d8e220f3c952cdee24c40caf4d96f22bb52fa574f739579c6db8359b2785a7d3cd03f2e081dd1c8
SSDEEP

24576:Yo0ZT/DyIA8keDcnKQ5vK/bmp1Kdxmp1wdx1p1sdx6p1tdx6s:Yo0ZTrrpkezQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.691581e3e9a61128d5d0947c4241ed70.exe

Files

NEAS.691581e3e9a61128d5d0947c4241ed70.exe
.exe windows:4 windows x86

27cfa54cf383e6ce76020bb22adeead6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm50

ord589
MethCallEngine
ord622
ord516
ord595
ord596
ord598
ord520
ord522
ord524
ord525
ord526
EVENT_SINK_AddRef
ord529
ord560
DllFunctionCall
EVENT_SINK_Release
ord600
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord607
ord608
ord530
ord534
ProcCallEngine
ord536
ord645
ord570
ord576
ord685
ord100
ord610
ord611
ord613
ord616
ord617
ord618
ord540
ord541
ord651
ord581

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ