NEAS[.]410bf6f2d701eb584fbe3234028de590[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.410bf6f2d701eb584fbe3234028de590.exe
Size

89KB
MD5

410bf6f2d701eb584fbe3234028de590
SHA1

5f8c821c029b6b2a90a4b1909f8a2b44ace44011
SHA256

81fe29e5a12fe1c7cff001eda91684d7204b9ea0eec1458b220548aeab56ddca
SHA512

a231d9bac7e4e96ea5ddfb5de7f552fbeba8dfa5d0fb88952b25bab551715e00363b04c537101faed7ac6c0e96452440ddbca2bc2728482e8599ae01975f4754
SSDEEP

1536:AWf50kAO1IYxq0QeghVUOv8RIylA7s5V8YU7U/:AWfquxIe8UOvqcYU7U/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.410bf6f2d701eb584fbe3234028de590.exe

Files

NEAS.410bf6f2d701eb584fbe3234028de590.exe
.exe windows:1 windows x86

734efa05f507eaa6cda5727493b71534

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

psapi

GetModuleFileNameExA

kernel32

CloseHandle
GetProcAddress
LoadLibraryA
OpenProcess
Process32First
Process32Next
RtlUnwind
Sleep
TerminateProcess
CreateToolhelp32Snapshot

user32

FindWindowA
GetWindowThreadProcessId

crtdll

_findclose
_findfirst
_findnext
__GetMainArgs
exit
fclose
fopen
fread
fseek
fwrite
raise
signal
_chdir
strcat
strcmp
strcpy
strlen

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88B - Virtual size: 88B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 780B - Virtual size: 780B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE