NEAS[.]496d045887e737fdf51021231a26f0a0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.496d045887e737fdf51021231a26f0a0.exe
Size

292KB
MD5

496d045887e737fdf51021231a26f0a0
SHA1

333f3982baaef496e9ace1ac89560aa6b61c821c
SHA256

05b75bb09c3ce9c1e7bdde1ba719461b654e87a414beeff17a57e88fea35bfd3
SHA512

9568d61ce27a7ab8c689201048e4dbd9b9180115db0793cb41cffbfe16c9a47209703cfdaba1c4e0af2dd52274904151d0ee0226d117a24fef010d80cdf5bb82
SSDEEP

6144:ATuN2z3rO9Jy0Z7Z64LAjpnru2z3rO9Jg9G:ATuoz8wLFBz8g9G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.496d045887e737fdf51021231a26f0a0.exe

Files

NEAS.496d045887e737fdf51021231a26f0a0.exe
.exe windows:4 windows x86

b2007e50941a260ea22e54bde387f806

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

MethCallEngine
ord662
ord595
ord598
ord632
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
ord600
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
ord607
ord608
ord716
ProcCallEngine
ord535
ord573
ord100
ord617
ord619
ord546
ord581

Sections

.text
Size: 184KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 96KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ