NEAS[.]0770c8d577ea496e5e9de3498bcb4039[.]exe | Triage

Sharing

General

Target

NEAS.0770c8d577ea496e5e9de3498bcb4039.exe
Size

1.5MB
MD5

0770c8d577ea496e5e9de3498bcb4039
SHA1

074d9e9888759aee5db28d83945148b495f432b5
SHA256

f2c2769ec393e23556e8ca4c8e9f0b14e1e5f6292016da94dda8ed0c4e99b09e
SHA512

4564c08c135c0e005f98e3807832f274178540dbdba4e7edc85a9afe46edc1510a6ac6bf3f3a12b301cf9af3e2dfcc4e296288639ab287716767305aee8b4ab9
SSDEEP

3072:NLsnN+833NHAF20aniRklWj8uHp1+2/J4cUorjTE6hWT83idKP50KC:ZsN+QhAPai5tHz+w4VoH46hMKPX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.0770c8d577ea496e5e9de3498bcb4039.exe

Files

NEAS.0770c8d577ea496e5e9de3498bcb4039.exe
.exe windows:5 windows x86

6d1f028787ecd18f946abf29ae022207

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetProcAddress
VirtualAlloc
VirtualFree
VirtualProtect

user32

EndPaint

advapi32

RegCloseKey

shell32

ShellExecuteA

iphlpapi

GetAdaptersInfo

ws2_32

htonl

wtsapi32

WTSRegisterSessionNotification

Sections

.text
Size: 65KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 443KB - Virtual size: 623KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Khsgd
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE