NEAS[.]63abd0d7d13115ff04717ae05fdb8890[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.63abd0d7d13115ff04717ae05fdb8890.exe
Size

163KB
MD5

63abd0d7d13115ff04717ae05fdb8890
SHA1

51dc9ba9d382e11b91e7d14cc04e75242d36ac7e
SHA256

53d5c27e77ac7bd6b94282538ac77a83399f4eb366b213c894b3c7051046392e
SHA512

c59aedf7481040df3f3571c6e9148a21305f6878d1db0d87ee173700d92380f2792e796a9f4a2447945477936f2f6a2e3ab65f0348ec9763f525ac387c75ff68
SSDEEP

3072:mnWjfso0f5z9f57jr07r3g4zEhiOzl0LEnFvUf4FnWRYCGisH/rsqEz:mnCp0f5z77jIdMlzl0L0dUf2WRNMfAqe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.63abd0d7d13115ff04717ae05fdb8890.exe

Files

NEAS.63abd0d7d13115ff04717ae05fdb8890.exe
.exe windows:4 windows x86

0a6a473d2b5b17b0655b936a480ca971

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

crypt32

CryptBinaryToStringW

kernel32

GetProcAddress
LoadLibraryA
VirtualProtect
SetLastError
GetModuleHandleW
GetLastError
GetCommandLineW
GetStdHandle
MultiByteToWideChar
GetFileType
LoadLibraryW
FreeLibrary
LocalFree
FindFirstFileW
LocalAlloc
WriteConsoleW
FormatMessageW
FindNextFileW
GetFileAttributesW

ntdll

_ultoa
wcsncpy
wcschr
wcslen
memmove
wcscmp
wcscpy
_wcsnicmp
wcscat
wcstoul
wcstol

user32

LoadStringW
DdeDisconnect

advapi32

RegOpenKeyExW
RegSetValueExW
RegQueryValueExW

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 12B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 54B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE