NEAS[.]b04a56b42e3b7e5dd37a20e80a9cb7b0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.b04a56b42e3b7e5dd37a20e80a9cb7b0.exe
Size

138KB
MD5

b04a56b42e3b7e5dd37a20e80a9cb7b0
SHA1

a299820bcb66904a0d51684b28ead39af850b014
SHA256

ab9676f985b3aaf040f09381cd0db0ba231eaac14178f8ff4fdd06a176629a59
SHA512

46fc42587dfadf99ab324950a77ccd20dd37bb573d1c28734f451838155fa8946790dd412e4f277d88d3f847dc06ed44594583be5ccde966f6d32c81105672b1
SSDEEP

3072:9hlkUC7wGnLduIVs/wGD0WQubZ0Bbm7HWKlrreiBDcO:9DkIGn8IVODChBSbWKl1DcO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.b04a56b42e3b7e5dd37a20e80a9cb7b0.exe

Files

NEAS.b04a56b42e3b7e5dd37a20e80a9cb7b0.exe
.exe windows:1 windows x86

214a4fdc45b1e49eaeb17c7ca1b86e49

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
GetModuleHandleA
GetProcAddress
GetTempPathA
LoadLibraryA
RtlUnwind
CreateFileA
CreateFileMappingA
VirtualProtect
lstrcpyA
CloseHandle
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoA
lstrlenA
GetVersionExA
GetSystemDirectoryA
CreateEventA
OpenProcess

crtdll

__GetMainArgs
exit
raise
signal

psapi

EnumProcesses

advapi32

RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegCloseKey
OpenProcessToken
FreeSid
AllocateAndInitializeSid

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 125KB - Virtual size: 364KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 384B - Virtual size: 384B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ