NEAS[.]8d531d63fffa20d0fa821040c9114480[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.8d531d63fffa20d0fa821040c9114480.exe
Size

192KB
MD5

8d531d63fffa20d0fa821040c9114480
SHA1

0d0a132ba58dec6f92f3ee8155a4ccd569c8c47f
SHA256

48151e2fc7c0973c10819b974c9cfd29b2b3f9ed608707075f1d6ad96b3cf3a9
SHA512

d03e96fbaef6a374014da3f1b72003cc0f7c6d5188b20b17657b9b868f91d0755fa5297331d420e623984032d4e449eef7dc028899864e3d506c00daf3ecb750
SSDEEP

6144:9v22X4W1nkg26yeRbxBZI9vbD4B5yKI9w:R1nbVxBS9vanew

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.8d531d63fffa20d0fa821040c9114480.exe

Files

NEAS.8d531d63fffa20d0fa821040c9114480.exe
.exe windows:1 windows x86

c5be99196a6c1865f2d20626faa31615

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CryptBinaryToStringW

kernel32

GetProcAddress
LoadLibraryA
RtlUnwind
VirtualProtect
HeapSize

shlwapi

PathAppendA

crtdll

__GetMainArgs
exit
raise
signal

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 40B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 748B - Virtual size: 748B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 268B - Virtual size: 268B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ