NEAS[.]a86abbb34ed93e3c57fd96a48c750a90[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.a86abbb34ed93e3c57fd96a48c750a90.exe
Size

61KB
MD5

a86abbb34ed93e3c57fd96a48c750a90
SHA1

7aa7fa9b68a5fecd65545ca983876a303f18ffbe
SHA256

cf668980d25c2d748c9e70e6f7e5a69e1f709c83538b08a58ed8fed4d7a93ae6
SHA512

16af8a451402dd7cfde6ccc0487920fc74d64140f9a92a04616b3ac7765d0b0170f58b5835d33917f897920e98ccfc6f23c2f2b2bd713592f5698becd93dee4e
SSDEEP

1536:pt3RAJeOO143LCTeqJ5UnslL2hLk14FnVf1p6eB:j3qMOOZUns92tk1iX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.a86abbb34ed93e3c57fd96a48c750a90.exe

Files

NEAS.a86abbb34ed93e3c57fd96a48c750a90.exe
.exe windows:4 windows x86

042d0fea2e92059b2a53ee91960ce9d3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetMessageA
RegisterClassExA
TranslateMessage
LoadIconA
LoadStringA
DispatchMessageA
BeginPaint
GetClientRect
EndPaint
PostQuitMessage
SetFocus
DestroyWindow
SendMessageA
PostMessageA
DefWindowProcA
CreateWindowExA
ShowWindow
LoadCursorA
UpdateWindow

kernel32

ExitProcess
HeapAlloc
GetCommandLineA
GetStartupInfoA
GetProcessHeap
lstrcpynA
LoadLibraryA
CreateDirectoryA
WriteProcessMemory
GetModuleHandleA

comctl32

ord17

wtsapi32

WTSEnumerateProcessesA
WTSLogoffSession
WTSQuerySessionInformationA
WTSWaitSystemEvent

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ