NEAS[.]f9a5624fd4c9fdb3f0fc0d8a38705520[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.f9a5624fd4c9fdb3f0fc0d8a38705520.exe
Size

204KB
MD5

f9a5624fd4c9fdb3f0fc0d8a38705520
SHA1

8b93def689a41f43d3492e3aab9f0f0846a73d0a
SHA256

57a0dfb9fa62bf9bf96b252c80f9c1ce00a35d0d0791c61a768b971f028e25f6
SHA512

269a8a7df5d62ebb9be70c2d87bf75f1fcbb24c5211d70f250ed19aa2f68743cdb0317ff822aa99b3e919909527fda1b3b457e5bd3fb728480b0cd335727f480
SSDEEP

3072:VVPA9jpOZeAVaABeTmuf/nMXP+ujnBtewzf74WYJf9J3J6Wv0BV3p7FFW:vdZeAVazTmJXP+6Bte0sWYJVTMD3phU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.f9a5624fd4c9fdb3f0fc0d8a38705520.exe

Files

NEAS.f9a5624fd4c9fdb3f0fc0d8a38705520.exe
.exe windows:1 windows x86

a3814a7202346127cdc45989a0827ff2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CryptBinaryToStringA

kernel32

GetLastError
GetProcAddress
LoadLibraryA
RtlUnwind
VirtualProtect
GetModuleHandleA
LocalFree

user32

GetCursorPos

crtdll

__GetMainArgs
exit
raise
signal

advapi32

EnumServicesStatusExW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 40B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 756B - Virtual size: 756B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ