NEAS[.]7547d3cbbe4074f34a4ee99967bf71f0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.7547d3cbbe4074f34a4ee99967bf71f0.exe
Size

138KB
MD5

7547d3cbbe4074f34a4ee99967bf71f0
SHA1

1e1f5bf5917d7706ecb1d6bbb9e8136fd75c47e3
SHA256

2f0d920e2b50278ab7e2663f740fdfd5b4db27eb0304a55f387bb67b3d119ad1
SHA512

34b954d66326f8454923f5d5cef4c3995a2cedc3f192aec7e7a5a8a31280a74cd721a879c46837497d0a32b811b7f335e192df303c8eaf6755a2a6952225e763
SSDEEP

3072:9hlkUC7wGnLduIVs/wGD0WQubZ0Bbm7HWKlrreiBDcO:9DkIGn8IVODChBSbWKl1DcO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.7547d3cbbe4074f34a4ee99967bf71f0.exe

Files

NEAS.7547d3cbbe4074f34a4ee99967bf71f0.exe
.exe windows:1 windows x86

214a4fdc45b1e49eaeb17c7ca1b86e49

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
GetModuleHandleA
GetProcAddress
GetTempPathA
LoadLibraryA
RtlUnwind
CreateFileA
CreateFileMappingA
VirtualProtect
lstrcpyA
CloseHandle
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoA
lstrlenA
GetVersionExA
GetSystemDirectoryA
CreateEventA
OpenProcess

crtdll

__GetMainArgs
exit
raise
signal

psapi

EnumProcesses

advapi32

RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegCloseKey
OpenProcessToken
FreeSid
AllocateAndInitializeSid

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 125KB - Virtual size: 364KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 384B - Virtual size: 384B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ