NEAS[.]bb4f877a24336f4d20986fcb44db59a0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.bb4f877a24336f4d20986fcb44db59a0.exe
Size

1.2MB
MD5

bb4f877a24336f4d20986fcb44db59a0
SHA1

8b0488cc2618637c617f06d6ac9a266005fa5080
SHA256

128bcd303c1186d271483d4e326ab04ffe89afa9e5ec4c98c78cf00f2720fc6c
SHA512

8f6da7720cbe4fe34f8ef8a0babeac0014365e704b8e6c8554e9c79804e473fd34ce4f1a656f76442d3786a2f9ebac53b05c1337af73404143cd6ce8339914ed
SSDEEP

6144:ZsN+QhAPai5tHr/MxHqnP3tCEr89EsbD62Z+w4VoH46hMKPX:W5hAPjPHr/wiPkEr89Eogw4VoH4cj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.bb4f877a24336f4d20986fcb44db59a0.exe

Files

NEAS.bb4f877a24336f4d20986fcb44db59a0.exe
.exe windows:5 windows x86

6d1f028787ecd18f946abf29ae022207

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetProcAddress
VirtualAlloc
VirtualFree
VirtualProtect

user32

EndPaint

advapi32

RegCloseKey

shell32

ShellExecuteA

iphlpapi

GetAdaptersInfo

ws2_32

htonl

wtsapi32

WTSRegisterSessionNotification

Sections

.text
Size: 65KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 443KB - Virtual size: 623KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Khsgd
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE