NEAS[.]ca46897d7469f84fc32fc3c500deea20[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.ca46897d7469f84fc32fc3c500deea20.exe
Size

8KB
MD5

ca46897d7469f84fc32fc3c500deea20
SHA1

2bd56f0179cc1fd5af428e77ed486dd1fe68adf0
SHA256

cc66c6d0f87ddd3d0c089982e20c88efadae520b31707ffb2a1e80649904a2ac
SHA512

ce0a4f469ab68eedf2f6656743132c6ba7f72c73dc00e54b7a17db69fbad68ede0e1e1e3f787167bffbdc07bbb6df854be1b0dd0b9d2e292f77c4a48a2f5f03a
SSDEEP

192:F4VbbMn3junK/47/Hoi+duTs5f0tQXFMp:Bn3OK/4TIi+8Q5f0tQXip

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.ca46897d7469f84fc32fc3c500deea20.exe

Files

NEAS.ca46897d7469f84fc32fc3c500deea20.exe
.exe windows:4 windows x86

18c3cd01b0b0d75bdb8ffaa773f7aba9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CreateFileW
DeleteFileW
ExitProcess
GetComputerNameW
GetCurrentDirectoryW
GetFileSize
GetProcAddress
GetModuleFileNameW
GetTempPathW
GetVersionExW
LoadLibraryA
ReadFile
WriteFile
lstrlenW
lstrcmpW
SleepEx
VirtualAlloc

user32

wsprintfW

wininet

HttpOpenRequestW
HttpSendRequestW
InternetOpenW
InternetConnectW
InternetCloseHandle
InternetReadFile

shell32

ShellExecuteW

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ