NEAS[.]c4c14cb35150a2e61366efbb40967cd0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.c4c14cb35150a2e61366efbb40967cd0.exe
Size

2.8MB
MD5

c4c14cb35150a2e61366efbb40967cd0
SHA1

1fe3a014aeabac928dd082bd748643f98ecc5830
SHA256

0c6fd1dac4839977062351251aee58c9ee96cb06c52fc6a4b1c8112265bb195f
SHA512

414b63287b08077abb2a811e0a00c74d815a8bbe30862a2331ff5b17fc32bf92dce80c546c7abef4a4269c7d5b23251994fcc62af470bb27ab3941f3ac4285d5
SSDEEP

49152:ptZNSttv2Pd2Pa6IMvYweQ5iZUe0f2NkTFdCsGjmuWe+wKy4oiHTxm/4HDtv8WxW:DZNG+b6I

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.c4c14cb35150a2e61366efbb40967cd0.exe

Files

NEAS.c4c14cb35150a2e61366efbb40967cd0.exe
.exe windows:4 windows x86

e724bea03515dde29f2b2b282d64f822

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

winmm

timeBeginPeriod

ws2_32

WSAGetOverlappedResult

ntdll

NtWaitForSingleObject

advapi32

CryptReleaseContext
CryptGenRandom
CryptAcquireContextW

kernel32

WriteFile
WriteConsoleW
WaitForSingleObject
VirtualFree
VirtualAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetThreadPriority
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
LoadLibraryA
LoadLibraryW
GetThreadContext
GetSystemInfo
GetStdHandle
GetQueuedCompletionStatus
GetProcessAffinityMask
GetProcAddress
GetEnvironmentStringsW
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerA
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 96KB - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.symtab
Size: 512B - Virtual size: 4B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ