NEAS[.]cd8d41c7970ca8731f74878521a13480[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.cd8d41c7970ca8731f74878521a13480.exe
Size

37KB
MD5

cd8d41c7970ca8731f74878521a13480
SHA1

5ce8640635217076c3ef237ed81d717607cfc4dd
SHA256

5cd11b7647c523added7c419c09a6c77f01fdbcee624e75f9aa18a3c794cfc99
SHA512

1dd7801b54f0e2df321768e1333bff44b686194339507856a67f5528bda673bb686f99535e9e3ee98d2e12187f5fa534fee32f480936874eef5084746376ff52
SSDEEP

384:tbTpjG7X9ehZjYp4K11p5rMhXh6UNqLI1RUxi/U4v7qBs81R9:BVjG7shxs/rZMhVQLicIZWr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.cd8d41c7970ca8731f74878521a13480.exe

Files

NEAS.cd8d41c7970ca8731f74878521a13480.exe
.exe windows:4 windows x86

33e2107d589315886e239f043e91b418

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_exit
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter

user32

SendMessageW
PostQuitMessage
DestroyWindow
DefWindowProcW
CreateWindowExW
ShowWindow
LoadIconW
RegisterClassExW
LoadStringW
GetMessageW
TranslateMessage
DispatchMessageW
UpdateWindow

kernel32

Sleep
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
LoadLibraryA
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleA
GetStartupInfoA
DeleteCriticalSection
lstrcpynW

comctl32

ord17

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ