NEAS[.]cab92004fad437da6c6a4989b31381e0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.cab92004fad437da6c6a4989b31381e0.exe
Size

480KB
MD5

cab92004fad437da6c6a4989b31381e0
SHA1

07b9e7171c1f8cd1a6f4836a8cb9d1bcce54f4dd
SHA256

34ecf79c7f78d8168fa0927d6866709d0155f0c2c6d9129be374b388a034b0cc
SHA512

b65910aed41c9a5ab21f95b06e3def0c591ce916467d025127a2fac861e2e92d0550677fd434716cae875102475dedc6338a83e37be431f7b137983ad59ae834
SSDEEP

6144:zXk4xUp0l3c+sAdM2DiNJZYwzEKODX41+59GtsPQFKe3L/7hW0i4HU7SsMZ7zQZ:zXMp0lRHQFcc050tsPiKiLDBi37R

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.cab92004fad437da6c6a4989b31381e0.exe

Files

NEAS.cab92004fad437da6c6a4989b31381e0.exe
.exe windows:5 windows x86

5ee0d146292a4d3cd3e543dd755df065

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

SetWindowTextW

advapi32

RegQueryValueExW

shell32

ShellExecuteA

ws2_32

gethostbyaddr

iphlpapi

GetAdaptersInfo

wtsapi32

WTSRegisterSessionNotification

oleacc

LresultFromObject

gdi32

DeleteDC

winspool.drv

OpenPrinterW

oleaut32

VariantClear

Sections

.text
Size: 449KB - Virtual size: 500KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 24B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE