NEAS[.]896fb69a9eca630d35315e8efdd9dcd0[.]exe | Triage

Sharing

General

Target

NEAS.896fb69a9eca630d35315e8efdd9dcd0.exe
Size

206KB
MD5

896fb69a9eca630d35315e8efdd9dcd0
SHA1

6613f62fb13734fe0b1626f7d3a301754389be92
SHA256

21471c9984b3eedd7d78d2a9ff71c79dd8501319b82d91220bb3201d1267dace
SHA512

cc72b9035e38db80c336a3a746e6f862f28ab03fcf5cecf69cef7c012d883413dbeffe664a608e50711faf8c98d3e81016f202365301ae2d19012038d22f061d
SSDEEP

6144:wczIyhH/NrZbZia5B0qsyiWXxYWJIDSiJz:LHlrJwkBFLxYWZil

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.896fb69a9eca630d35315e8efdd9dcd0.exe

Files

NEAS.896fb69a9eca630d35315e8efdd9dcd0.exe
.exe windows:5 windows x86

cd0b29dabdb2fa1e5851e1e7a7fda9ae

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
GetOEMCP
HeapAlloc
SetLastError
lstrcpyA
GetCurrentProcess
GetTickCount
lstrlenA
QueryPerformanceCounter
LockResource
LoadLibraryW
GetCurrentProcessId
WideCharToMultiByte
lstrcmpA
CreateFileA
GetProcessHeap
HeapFree
MultiByteToWideChar
IsValidLocale
GetVolumeInformationA
SetUnhandledExceptionFilter
GetLocalTime
GetLocaleInfoA
FindResourceA
SystemTimeToFileTime
GetSystemTimeAsFileTime

schannel

QueryContextAttributesW
InitializeSecurityContextW
QuerySecurityPackageInfoW
QuerySecurityPackageInfoA
QueryContextAttributesA

scecli

SceAddToObjectList
SceAppendSecurityProfileInfo
SceCloseProfile
SceBrowseDatabaseTable
SceAnalyzeSystem
SceAddToNameStatusList

advapi32

RegCloseKey
RegQueryValueExA
RegQueryValueExW
RegOpenKeyExA

Sections

.text
Size: 143KB - Virtual size: 142KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rcrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ