NEAS[.]82ec96546ea5634578b953f1fa25fcf0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.82ec96546ea5634578b953f1fa25fcf0.exe
Size

47KB
MD5

82ec96546ea5634578b953f1fa25fcf0
SHA1

dbbd5394c36404d63a50b0dffd4c802e71da5f89
SHA256

2ca4c2ba83237fd35fde41e717e65563e0399047f4fb859bcd275a7707d0965f
SHA512

494bee6b57789a2ac23fa7fa5dbc3e892da614cad88512ad7142407e223bb5612384d969ebba00aa5cf06aaaad4f4faf7e749888c626f532dd088652f702ff8e
SSDEEP

192:Rc9jpZ11VDPq8mtrem1eC7e9ipDNGWvMzB/JtMSi:Rcln1Tm/em1ewe9ipBGeaJvi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.82ec96546ea5634578b953f1fa25fcf0.exe

Files

NEAS.82ec96546ea5634578b953f1fa25fcf0.exe
.exe windows:4 windows x86

9eeefa7f6cdca34a42a6c3913e8fb403

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetCommandLineW
GetTempFileNameW
FreeResource
FindResourceW
LoadResource
CreateProcessW
WaitForSingleObject
GetModuleHandleW
GetTickCount
WriteFile
SizeofResource
GetFileAttributesW
GetModuleFileNameW
CreateFileW
lstrlenW
GetTempPathW
LockResource
lstrcatW
CloseHandle

shell32

SHFileOperationW

shlwapi

StrChrW
StrRChrW

msvcrt

??2@YAPAXI@Z
??3@YAXPAX@Z
malloc
free
memmove
memset

Sections

pe
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ