NEAS[.]4d47e2ecb767eaa52ea5bf3fbbdb6950[.]exe | Triage

Sharing

General

Target

NEAS.4d47e2ecb767eaa52ea5bf3fbbdb6950.exe
Size

292KB
MD5

4d47e2ecb767eaa52ea5bf3fbbdb6950
SHA1

29194d8b5559022fa008f8d52410bd6785f9b49d
SHA256

6f66f8bc22092d164dbc5bd6b9edb2174f02df7dbcd9d2aa3bb777babd6f621e
SHA512

46d319e1bc35931d0c76b2fb148874312036b6fd0ec6e86d749b406daeefbd88f5c165b11a21ca4f32dd2559399e62b59e51e3311d47ed4a9d1052450779fec4
SSDEEP

6144:GzLxdgY9ODU7xr5Kd2IdJi0QFk5PIOpby/H:S1xmUlrKdgdk5wEby/H

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.4d47e2ecb767eaa52ea5bf3fbbdb6950.exe

Files

NEAS.4d47e2ecb767eaa52ea5bf3fbbdb6950.exe
.exe windows:4 windows x86

9ffc59d97fa7bc95242d6970ebf528e1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetACP
CreateFileA
VirtualAlloc
GetOEMCP
GetCurrentProcess

user32

LoadCursorW
LoadCursorA

msvcrt

__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
_acmdln
__set_app_type
_controlfp
_except_handler3
exit
_XcptFilter
_cexit
_exit
__p__fmode
_c_exit

advapi32

RegOpenKeyA
RegQueryValueExA

Sections

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata51
Size: 254KB - Virtual size: 254KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ggg22
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ