NEAS[.]2fcd739a0a7e3909358c0f24237f0750[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.2fcd739a0a7e3909358c0f24237f0750.exe
Size

96KB
MD5

2fcd739a0a7e3909358c0f24237f0750
SHA1

372547559be235921bc664abfa839c876c1cb209
SHA256

3076b09383c03cbe03bd0664775781f84265e577fe3417162d82ade657d9b459
SHA512

7371e2dc2b877a77677fc303967bf3c71541ceb7ef18bf78f54fbaff869602d9e4ba6dbea82168f258ddbd4e6804b58c8b921a62841eb05027b3ef4fb7723631
SSDEEP

1536:8V5MJhfJ8daS+2GCct27MAH5ydNKLXiP1BQ3eRUX+gYgD0OafRqHVsY54lQvY05:8V5MXGdRlFH5egyDQ3eSOtS0Hf4Hum4+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.2fcd739a0a7e3909358c0f24237f0750.exe

Files

NEAS.2fcd739a0a7e3909358c0f24237f0750.exe
.dll regsvr32 windows:4 windows x86

5a43387490a8980e5a7709455409eb83

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

mfc42

ord5241

msvcrt

wcslen

user32

IsWindow

gdi32

CreateFontIndirectA

shell32

SHGetPathFromIDListA

ole32

CoCreateInstance

oleaut32

LoadRegTypeLi

msvcp60

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

dhnetsdk

ord26

dhplay

ord98

ws2_32

getservbyport

version

GetFileVersionInfoSizeA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 79KB - Virtual size: 256KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE