NEAS[.]b1483c18af47a7201a2e2aedd7b1dd50[.]exe | Triage

Sharing

General

Target

NEAS.b1483c18af47a7201a2e2aedd7b1dd50.exe
Size

302KB
MD5

b1483c18af47a7201a2e2aedd7b1dd50
SHA1

c88dd2d7dd3a10aaca757f016cf66cf0add03591
SHA256

1e04bcc9d43e6ab8a4b194ac01d6dd34b741ecc06ff0d027e90b7140b3041247
SHA512

1e98359d30388115180f4fd24615e14cdf0113dba69e439d469596007f0655b40b8c3a949f14f7c880157748e32b51b4269e8313386bac8fe2ec93f35e55528d
SSDEEP

1536:JCe3Ce3CefCePCeNI0ifySa6B8PLNYf/nWHNTdv95:JZ3Z3ZfZPZxiHaECxYf/nWHNp95

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.b1483c18af47a7201a2e2aedd7b1dd50.exe

Files

NEAS.b1483c18af47a7201a2e2aedd7b1dd50.exe
.exe windows:4 windows x86

d66b543d0999c7628a55690ef9b1c96e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCloseKey
RegOpenKeyExA
RegSetValueExA

kernel32

AddAtomA
CloseHandle
CopyFileA
CreateThread
ExitProcess
FindAtomA
FindFirstFileA
FindNextFileA
GetAtomNameA
GetCommandLineA
GetModuleFileNameA
GetModuleHandleA
GetStartupInfoA
GetSystemDirectoryA
SetUnhandledExceptionFilter
Sleep

msvcrt

__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_iob
_onexit
_setmode
abort
atexit
exit
fclose
fflush
fopen
fprintf
fread
free
fseek
ftell
fwrite
malloc
rand
signal
sprintf
strcat
strcmp
strlen

shell32

ShellExecuteA

user32

GetForegroundWindow
SendMessageA
SetWindowTextA

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 752B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 496B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE