NEAS[.]970c02cc9f0428f8b7fc3c279b99acf0[.]exe | Triage

Sharing

General

Target

NEAS.970c02cc9f0428f8b7fc3c279b99acf0.exe
Size

144KB
MD5

970c02cc9f0428f8b7fc3c279b99acf0
SHA1

7ae048ab183083ff558f624c84e70be6b1aa9fc5
SHA256

d751bacee447bf591e5575065346cbc7845f26448157e063b78be957504874d2
SHA512

ac21cd2639297040d728b1412deb4fef514ce72f80d2275ff0718a9cede500687255d3a7b7d36725f99f07dfcae1aa1374eb8b8102a97cbca744ad58eacac5c4
SSDEEP

3072:ynNOu3ap01kqMTue72EMD26/+4TFTHugCoReiVWeJfefVUxo:MKp+kqKt72EMiA+4TFbIyVWeU2xo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.970c02cc9f0428f8b7fc3c279b99acf0.exe

Files

NEAS.970c02cc9f0428f8b7fc3c279b99acf0.exe
.exe windows:1 windows x86

84b346c4696dd5bf782e43918d6653c3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

iphlpapi

GetAdaptersInfo

kernel32

GetModuleHandleA
GetProcAddress
CloseHandle
RtlUnwind

user32

GetCursorInfo

crtdll

__GetMainArgs
exit
raise
signal

ntdll

RtlInitUnicodeString
RtlFreeHeap

advapi32

RegOpenKeyExA
RegQueryValueExA

ulib

?Usage@PROGRAM@@UBEXXZ

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 40B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 896B - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc2
Size: 313B - Virtual size: 313B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE