NEAS[.]394ba7aa0867887201ea91eba24d1180[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.394ba7aa0867887201ea91eba24d1180.exe
Size

6KB
MD5

394ba7aa0867887201ea91eba24d1180
SHA1

0502998ec06cef9ea040eeaa647d6199e46a4071
SHA256

1e7616c0bc76026cda8fd052b11f50d999302784320fa50fdd8d5902b206489a
SHA512

5c1721c794b5e4f0b106d13b7b5e1cbee62aac65dc8a71f43d5ef36be417ac3d0bea579e5b33d32e257099fbdf5abdbbdfed0e614b17d3452fb2ed4527763f73
SSDEEP

96:hy859x0P8Ma4qhrreOCloiJ4M1YLFk/MhL:F5oLBerpCloa4CYhk/6L

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.394ba7aa0867887201ea91eba24d1180.exe

Files

NEAS.394ba7aa0867887201ea91eba24d1180.exe
.dll windows:5 windows x86

c4c9ecfc26ca516a80b8f6f5b2bdb7e6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryW
GetProcAddress
CreateFileA

msvcrt

free
_initterm
malloc
_adjust_fdiv

Exports

Exports

rundll32

Sections

.text
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 385B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ