NEAS[.]a35d5761d77cc24b4f6e63e718c8ac70[.]exe | Triage

Sharing

General

Target

NEAS.a35d5761d77cc24b4f6e63e718c8ac70.exe
Size

170KB
MD5

a35d5761d77cc24b4f6e63e718c8ac70
SHA1

7c039b3caa04739692979aefadfb32a617a79f1f
SHA256

46066559e259609a51c63c54f19d60e8fb305c2996b71108e69fe1c206ec3764
SHA512

5b073d4a2b7a00b52203790e141708b52857c86aaefa2921bc4dfd1e3dcd0275c34fe73a5e263d5e9e22984ee85c0f3cdf7fd2b022a82919ecf12373cd98ea40
SSDEEP

3072:Wbg/Zb5iCiXYteEp/tJzRgWf1hGLi0BCxAlJyRGQCfeypNfzSeKkCciI:vBdiDIFJ/zRr1gLi4BlJyJC2yp4e9iI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.a35d5761d77cc24b4f6e63e718c8ac70.exe

Files

NEAS.a35d5761d77cc24b4f6e63e718c8ac70.exe
.exe windows:1 windows x86

b182e386c09eced3853648b178cfc1ae

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CryptBinaryToStringW

kernel32

GetProcAddress
LoadLibraryA
RtlUnwind
VirtualProtect
InterlockedCompareExchange
GetModuleHandleA
CloseHandle
Sleep
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoA
GetLastError

crtdll

__GetMainArgs
exit
raise
signal

advapi32

RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegCloseKey

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 150KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 204B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE