NEAS[.]d067151a47ac83c782012335c55e4600[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.d067151a47ac83c782012335c55e4600.exe
Size

96KB
MD5

d067151a47ac83c782012335c55e4600
SHA1

e380450bbb18af48057f3c0b4126700b24dd0556
SHA256

e3d1fd3951df0ab066bb5f2decfa2f8b452e72cc03fb488565b155e3ad309add
SHA512

85cb6d2a92fa85dacd61b531da7a6f0473d47687f9dcf2feee12c1c78ad55b015c74db03d338c28285a63915db0692ed52ed0f474146bfbe75f70b5b20c1f5f1
SSDEEP

1536:OVNSf7hyk+I6412V6PMqAax80XAFSrRuV:SSf9yk+U2V63XAFSrRq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.d067151a47ac83c782012335c55e4600.exe

Files

NEAS.d067151a47ac83c782012335c55e4600.exe
.exe windows:5 windows x86

0387d7197769bd3cd788524003bf2efa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

user32

EndPaint

advapi32

RegCloseKey

shell32

ShellExecuteA

ws2_32

WSAStartup

iphlpapi

GetAdaptersAddresses

Sections

.MPRESS1
Size: 39KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE