NEAS[.]20e4862efb803432d88bf44647cc6a80[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.20e4862efb803432d88bf44647cc6a80.exe
Size

132KB
MD5

20e4862efb803432d88bf44647cc6a80
SHA1

f047454598591a3036572138ebeff23cd8a0eaa2
SHA256

cc7e47a7ab282411ee3d6b31b0b3259625ad079eb64dcce54989e0710fd60b2d
SHA512

7ce491714cb391e6f62cfa29e68958a8b6ade7c0b7fe042a07099f963baee3e027c2e7f0d5ab0f522a697b1985b26331e3614dea98357c2a2785f9941e0598db
SSDEEP

3072:xvFUa0b8w7wTKGR5qoFKnaymV/atYdkGT0CUuS4hsD4ruwo:xvFUfITHkLMLss5o

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.20e4862efb803432d88bf44647cc6a80.exe

Files

NEAS.20e4862efb803432d88bf44647cc6a80.exe
.exe windows:5 windows x86

d40391ee5183450092ed26706cbedad8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

user32

EndPaint

gdi32

SetBkColor

advapi32

RegOpenKeyW

msvcrt

exit

Sections

.MPRESS1
Size: 125KB - Virtual size: 360KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 552B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE