NEAS[.]f4fa687dcee15a41caafb209a629dda0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.f4fa687dcee15a41caafb209a629dda0.exe
Size

491KB
MD5

f4fa687dcee15a41caafb209a629dda0
SHA1

3306342d14ab8afd419783678b10ca96dcb5016e
SHA256

a25949dd57840efa00bcbaa3120ff6b6e3c7871129bb8251ff3ce3b1c57c7f73
SHA512

505a3033dbed8cd71f38e4bc47e80e99cea72b540d84cbcc453f90d305c51f03efa2d0971efb3361626c7813185fa845fb5ee2827293c0ed7a2d35f02a8a2ff2
SSDEEP

12288:hWBl9ZajFQP65/hSCIi8j2cBVHyUWefJ79dFAMp:KlLGyi3Sl5j2cBVae5ew

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.f4fa687dcee15a41caafb209a629dda0.exe

Files

NEAS.f4fa687dcee15a41caafb209a629dda0.exe
.exe windows:5 windows x86

fa16514816757202a1497c61157ed4aa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

advapi32

GetAce

comctl32

ImageList_ReplaceIcon

comdlg32

GetOpenFileNameW

gdi32

StrokePath

iphlpapi

IcmpCreateFile

mpr

WNetUseConnectionW

ole32

CoTaskMemAlloc

oleaut32

LoadTypeLibEx

psapi

GetProcessMemoryInfo

shell32

DragQueryPoint

user32

AdjustWindowRectEx

userenv

DestroyEnvironmentBlock

uxtheme

IsThemeActive

version

GetFileVersionInfoW

wininet

InternetQueryDataAvailable

winmm

timeGetTime

wsock32

WSACleanup

Sections

.text
Size: 447KB - Virtual size: 1008KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 43KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE