NEAS[.]56fdfb8d3782c976cc150da857da0fb0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.56fdfb8d3782c976cc150da857da0fb0.exe
Size

1.1MB
MD5

56fdfb8d3782c976cc150da857da0fb0
SHA1

2f144f1e7a1c890f515f51f4c81834cfa80266aa
SHA256

8056495b1aead96441a9ddcd7612dd45ca428e7ecc628df1361a415b22f36079
SHA512

b0e0fcfa2c3c2fe50b5c057b3aec1f2ae70e8907e3093e576a5f65d2e94e25eefd5d1af1911ad6a5e12218c4f87206a976025f5fc36d32050ed17fd2fc3511bb
SSDEEP

24576:LCiFeMlmKNbmNHmS/3mdQz8RxVv50WFLdp4abR:LTeWQJXuCz83Pp4ad

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.56fdfb8d3782c976cc150da857da0fb0.exe

Files

NEAS.56fdfb8d3782c976cc150da857da0fb0.exe
.exe windows:1 windows x86

7c8abe14184660036988d6f66a50caea

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
ExitProcess
GetModuleHandleA

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

VariantChangeTypeEx

mpr

WNetGetUniversalNameA

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

CoUninitialize

comctl32

ImageList_SetIconSize

comdlg32

GetOpenFileNameA

Sections

pec1
Size: 169KB - Virtual size: 424KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE