NEAS[.]6ce4233d118c31b72fbb359d6baf6cd0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.6ce4233d118c31b72fbb359d6baf6cd0.exe
Size

376KB
MD5

6ce4233d118c31b72fbb359d6baf6cd0
SHA1

17567d0b62e2b45cec8621d5bf0667a40ebfa24a
SHA256

8dce075ecdd6de5f1575675fd6f45c8069a1f8ba3b05edaf6b6b440f4f997b76
SHA512

61a88bf46a8f96ac34ddd7ac1a8964a96c28558cd8167fec5114d73e6a72a35724b8aa8e9d9fa6aedf1cabc6739c7986e723a90dde16851f184a9b5aecc26e79
SSDEEP

6144:IvVcRLycDYWDX2r0GtX2SblhJ2RiegM827XHjfKosVSPX4tNo/sHDwn:IvVcRLyQYWDw0GZ2Qlj2RVgX2zHjOEPd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.6ce4233d118c31b72fbb359d6baf6cd0.exe

Files

NEAS.6ce4233d118c31b72fbb359d6baf6cd0.exe
.exe windows:4 windows x86

4d4238254354e35d40cf0ec441d960c4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

powrprof

SetActivePwrScheme

pdh

PdhGetFormattedCounterValue

psapi

GetModuleFileNameExA

version

GetFileVersionInfoSizeA

user32

PostQuitMessage

gdi32

GetViewportExtEx

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA

advapi32

RegCloseKey

shell32

Shell_NotifyIconA

comctl32

ImageList_GetIconSize

oledlg

ord8

ole32

CoFreeUnusedLibraries

olepro32

ord253

oleaut32

VarDateFromStr

Sections

.text
Size: 246KB - Virtual size: 752KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE