NEAS[.]397190aa749506768e9bd72d1add1b20[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.397190aa749506768e9bd72d1add1b20.exe
Size

482KB
MD5

397190aa749506768e9bd72d1add1b20
SHA1

bae7d87f05bc03b874b1b2ef5fd6627955d031b3
SHA256

78141878e2342839f18bcb7c6c9f61fab0f0d800bc5b493b82b15694131eca3f
SHA512

6205ddcc93812a4c7e2fc9433e2abeccc9def082f66383160842d86c59a3c164450486115d5f45c29149c18eb2587e4c53233df703174a731c078c7284d99907
SSDEEP

6144:Ptozn+Wlxaki4aEVd+9fg0lnwzBDFqzRoRXOmbvRQ20g9P:K+Wlo++9fg0lwzN0RY+mbvr7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.397190aa749506768e9bd72d1add1b20.exe

Files

NEAS.397190aa749506768e9bd72d1add1b20.exe
.exe windows:5 windows x86

22953c0222c374b5c6b3341a48df763b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

LoadCursorW

advapi32

RegQueryValueExW

shell32

ShellExecuteW

ws2_32

WSAStartup

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 72KB - Virtual size: 200KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE