NEAS[.]80881cc521d290345694d199e0768aa0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.80881cc521d290345694d199e0768aa0.exe
Size

203KB
MD5

80881cc521d290345694d199e0768aa0
SHA1

f3d64045c3b6843a379a09c89a789a0a7d55e1f2
SHA256

8bd1cd95c819f6b3ee0cb523aa756d34684940d2d037ee142b83c1f28704e25d
SHA512

0ed8354b617ef885d4e58ab2d112b56dbfdd1b30a446212a762c58e502b64a13f5a7de84427ece4dcd20bad1c51847df177c1582be64217d625d8e5230441b6c
SSDEEP

3072:l1BqxuUaKjU3TicAHJsow3zpEENchbNKh5Va79ayiC:PBqxbamcAHJ636+chbW5ValiC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.80881cc521d290345694d199e0768aa0.exe

Files

NEAS.80881cc521d290345694d199e0768aa0.exe
.exe windows:1 windows x86

3fb21e5f497aea5d71eb496a19c6c509

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
LoadLibraryExA
FlushInstructionCache
GetModuleHandleA
CloseHandle
lstrcmpiA
GetCurrentThreadId
GetCurrentProcess
UnhandledExceptionFilter
GetStartupInfoA
GetLastError
GetCommandLineA
lstrlenA
GetVersionExA
GetModuleFileNameA
FreeEnvironmentStringsA
MultiByteToWideChar
HeapDestroy
VirtualFree
VirtualAlloc
HeapFree
GetLocaleInfoA
GetProcessHeap

advapi32

RegOpenKeyExA
RegQueryValueExA

user32

SetWindowLongA
DefWindowProcA

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ