NEAS[.]b2b19a20f3cc808d86181b971bbd0840[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.b2b19a20f3cc808d86181b971bbd0840.exe
Size

2.6MB
MD5

b2b19a20f3cc808d86181b971bbd0840
SHA1

449d750f6e9c6071204fa04e33eae2dbd615d119
SHA256

7d34c68a0724c2e8bafe0ed9a86fc52a8281d3f3368593bff0aaedf47702c9c5
SHA512

878104590bb4537039d5fd9e128086480e2b0a16a699abfc4e27a9540215e5e64119550bc5decbadc220922c78c231eb93b83a283ea015cd24ebdbf20e307684
SSDEEP

49152:buOw7kuP8/ThsUMUJRWzj6CRN1xyxYASLPOhDnuRtliUEa/BGHwrL4:6dk6rUD/ExytJ+tAUZ/BprL4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.b2b19a20f3cc808d86181b971bbd0840.exe

Files

NEAS.b2b19a20f3cc808d86181b971bbd0840.exe
.dll windows:5 windows x86

b988d6d0dc8d261e1b27ddad87f3dd68

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvfw32

DrawDibGetPalette

mprapi

MprAdminMIBEntryGetNext

shell32

SHBindToParent

lz32

LZRead

kernel32

GetModuleFileNameW
GetUserDefaultLangID
GetModuleFileNameA
BuildCommDCBAndTimeoutsA
GetModuleHandleA
GetBinaryTypeA

user32

DeregisterShellHookWindow

version

VerFindFileW

ws2_32

select

Sections

.text
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_MEM_READ

.data
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ZVqPQ
Size: 164KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

*saxC
Size: 168KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 944B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ