NEAS[.]a369b054f64999d8ff97a4dd6dd6b950[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.a369b054f64999d8ff97a4dd6dd6b950.exe
Size

4.9MB
MD5

a369b054f64999d8ff97a4dd6dd6b950
SHA1

56bc4a031033b4f38de0852b19ee055b145183db
SHA256

901d8fa83b3f46d195f1ecef77eb4009254dcb9a0369977d775074a25be0e5fa
SHA512

76e8c620d583b33b6b70a1b2324e098a420491f05ccb66e6548b232f324c30e7e126d9460ed88dd72e11b127aff8e954f49e90b0940d5b11f1909411cb8dcae1
SSDEEP

98304:i5zFEnD1jai9cxbjP72Uo5gNujjfjLw0eCUVc2nAB4a:ihFEDtaiQbpow0XRuvu4a

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.a369b054f64999d8ff97a4dd6dd6b950.exe

Files

NEAS.a369b054f64999d8ff97a4dd6dd6b950.exe
.exe windows:4 windows x86

b3acd490cd8de60fd3429211870a2a19

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

rasapi32

RasHangUpA

winmm

midiStreamRestart

ws2_32

WSAAsyncSelect

user32

DrawStateA

gdi32

ExtSelectClipRgn

msimg32

GradientFill

winspool.drv

OpenPrinterA

advapi32

RegCloseKey

shell32

SHGetSpecialFolderPathA

ole32

StgCreateDocfileOnILockBytes

oleaut32

SysAllocString

comctl32

ImageList_GetIcon

oledlg

ord8

wininet

InternetCanonicalizeUrlA

comdlg32

GetSaveFileNameA

Sections

.text
Size: 4.9MB - Virtual size: 11.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE