NEAS[.]e8acc8b4d0e99968a0c43aa5219a6a40[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.e8acc8b4d0e99968a0c43aa5219a6a40.exe
Size

195KB
MD5

e8acc8b4d0e99968a0c43aa5219a6a40
SHA1

b33b8a926f760abf78535766963e304e2e1827ee
SHA256

e9daabbaa1c6a1871e049d59f9583fba324201245327baa249ef6cd9018eee29
SHA512

78a4c673eacdbe7b1b4877af5ad28365800fc7ac2a158f56e9c44f626914264eff96e23ed3257f9aebcbf0e62fc2fe244518296b38a080f37ea632eec0b80676
SSDEEP

3072:pr1EEnCsT0DG4r6wOQR9khaFtkWOcB1ADM4guYs:h1EEnhTSG4r6FQr/OpM45Y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.e8acc8b4d0e99968a0c43aa5219a6a40.exe

Files

NEAS.e8acc8b4d0e99968a0c43aa5219a6a40.exe
.exe windows:4 windows x86

b450e6ae9d47b821b6f1da1c30f1e6b3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

version

VerQueryValueA

ntdll

RtlGetNtVersionNumbers

urlmon

UrlMkGetSessionOption

shell32

SHGetSpecialFolderLocation

wsock32

WSACleanup

rpcrt4

UuidCreateSequential

Sections

CODE
Size: 124KB - Virtual size: 376KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE