NEAS[.]6aadac8e218ebb5b522e0de4c2cc4c80[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.6aadac8e218ebb5b522e0de4c2cc4c80.exe
Size

124KB
MD5

6aadac8e218ebb5b522e0de4c2cc4c80
SHA1

eaa80e66348677fc69227bb6842d4d58d79a8080
SHA256

d33a785174b838974ef3a9c9acbdca2311bf80a5f28622572e89a3bef11e3954
SHA512

3b9094b5303eba3df3039af00b407c5b0687c0798fcd4137e5beb260a42d8ac4765ed28fff56cf7a614f2344d016035d9699eaf131f3c51026ec10d62387398a
SSDEEP

3072:Pu2hf5oABDhr6OY0NY2GcZskIowY8Nv7JC0:G2hBVBNrA2YEsCwM0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.6aadac8e218ebb5b522e0de4c2cc4c80.exe

Files

NEAS.6aadac8e218ebb5b522e0de4c2cc4c80.exe
.exe windows:5 windows x86

d1ccd6fd8ac971fa9573cb954fba5aca

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

IsCharUpperW
GetMessagePos
IsCharAlphaW
GetForegroundWindow
MapDialogRect

kernel32

lstrcpyW

msvcrt

atoi
srand

shlwapi

StrCmpLogicalW

Exports

Exports

?NOTEBOOK@@YG_JUessentialArray@@UL
?PHONERING@@YG_JUessentialArray@@UL

Sections

.text
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.p1
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.crt
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ