NEAS[.]76ca72a87d253fc756ea2088d643f6f0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.76ca72a87d253fc756ea2088d643f6f0.exe
Size

66KB
MD5

76ca72a87d253fc756ea2088d643f6f0
SHA1

6bbceadd2bea953a9f9c84cabbd348d33a98038d
SHA256

d79eef89692d3a9acc8de21a1c9ac6d06437b0ce8b5706077b6b8b5600e7a3c7
SHA512

575a0a8e220936d040e0513e5c4e4b98054c7824d8cbeefb7fc1e45c693e1948133ddb8fd878f7b608dcfba35c4a85f4ab4fbdfaf19b71a35b958527c0c2c478
SSDEEP

1536:dTw+sh6rAKOav62kcjQs88vsLmMVyDSVYh2Q0hn:GXWATavTHYUsLmJDS4on

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.76ca72a87d253fc756ea2088d643f6f0.exe

Files

NEAS.76ca72a87d253fc756ea2088d643f6f0.exe
.exe windows:4 windows x86

707f8a25058b999ec5686d1e4e939c83

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempFileNameW
GetAtomNameA
LZInit
EraseTape
BaseCheckAppcompatCacheExWorker
lstrcpynA
GetStringTypeExA
RemoveDirectoryTransactedW
GetCommandLineA
DosPathToSessionPathW
RegOpenKeyExW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE