NEAS[.]47844d66acffd5c67789fe1b5829b750[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.47844d66acffd5c67789fe1b5829b750.exe
Size

150KB
MD5

47844d66acffd5c67789fe1b5829b750
SHA1

1f4785ebfdc52bbb4e50d85d75181d5a31907b9b
SHA256

781603ac94033e0de4168dd2f5afb58c9e6ea7b9d440d6dee1ac28994a511ea5
SHA512

70caff1fd6ea99633fda8797126f192b507295c0fd3b73abbc1e50e07a05c2a5672a1ba0d7fd1eb27c424f749e20ff85145a8bc386d4cd22a912ded5bb39afec
SSDEEP

3072:VSNXsMNzLndpD2BX4TPKtdp2fSZ+A1ptL3y35V1CDfY5ISv9TpYVKlp:cNXhn7D2BXaETySZ+iL3yKfYGSFF/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.47844d66acffd5c67789fe1b5829b750.exe

Files

NEAS.47844d66acffd5c67789fe1b5829b750.exe
.exe windows:1 windows x86

75a256b0bc0d0512d33719c33807e4b1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

iphlpapi

GetAdaptersInfo

kernel32

GetLastError
GetModuleHandleA
GetProcAddress
CloseHandle
RtlUnwind
LoadLibraryA

user32

GetCursorInfo

crtdll

__GetMainArgs
exit
raise
signal

ntdll

RtlInitializeSid
RtlFreeHeap
RtlAllocateHeap
NtOpenKey
RtlInitUnicodeString
NtClose
RtlLengthSid
RtlSubAuthoritySid
RtlLengthRequiredSid
RtlCopySid

ulib

?AnalyzePath@PATH@@QAE?AW4PATH_ANALYZE_CODE@@PAVWSTRING@@PAV1@0@Z

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 40B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc2
Size: 417B - Virtual size: 417B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE