NEAS[.]76484610d483546c30fe4989a73f90e0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.76484610d483546c30fe4989a73f90e0.exe
Size

147KB
MD5

76484610d483546c30fe4989a73f90e0
SHA1

16b67f9c99f49819d87a0b6d9dc98220d9fc7f96
SHA256

32870476e3a3958b99597662fa7fa552f1500c242f46fb949f9860178287c383
SHA512

149bf38bf4b07d7c14d5635c19c755a94c47051aa9e715859c9b300da4e6baa50c6991cf0f3c7933bda7fc9beb2aacd9074661cabc3eab0a2c92f14af5d10339
SSDEEP

3072:yA4GU4QVmTIVPE7YaXYCfNicisIIMQgqoMNw21cuFQaArhGOU1nmi5GuMm:yF4OVPasyFQaAUn+uMm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.76484610d483546c30fe4989a73f90e0.exe

Files

NEAS.76484610d483546c30fe4989a73f90e0.exe
.exe windows:1 windows x86

4d82a1a8ac7dae247b7e65f9bf1173b2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CryptBinaryToStringA

kernel32

GetLastError
GetProcAddress
LoadLibraryA
RtlUnwind
VirtualProtect
GetModuleHandleA
FormatMessageA
LocalFree
GetTickCount
LocalAlloc
InterlockedCompareExchange

user32

GetCursorPos
CharToOemBuffA

crtdll

__GetMainArgs
exit
raise
signal

mswsock

s_perror

ws2_32

WSASocketW
WSAEventSelect

advapi32

RegOpenKeyExA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 40B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 126KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc2
Size: 427B - Virtual size: 427B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE