NEAS[.]f894d92b5bed9b636c1ecc7bdf75c030[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.f894d92b5bed9b636c1ecc7bdf75c030.exe
Size

997KB
MD5

f894d92b5bed9b636c1ecc7bdf75c030
SHA1

84de1bee6a68427993f4c39aa0fb1680cd7890ff
SHA256

0152bdaf7ddf20c468933caa4e10ad627f5dbda853b4aedeaccc1f385b038e72
SHA512

82deef282eb8b5dac5c07311412dc8e953f9b0060be74d582c2d23c4edafa15c3317fd88a096d9039e621f6dfff6164951b66278a474f6b6b4fa6b990e6ce46e
SSDEEP

12288:LIZp+91V197J+q9SOuNZRslg8lt01PBExKN4P6IfKTLR+6CwUkEoIL:MG91V31+p7slNlks/6HnEp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.f894d92b5bed9b636c1ecc7bdf75c030.exe

Files

NEAS.f894d92b5bed9b636c1ecc7bdf75c030.exe
.exe windows:4 windows x86

c054cd709f7cbc5ef65446bf04509206

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetModuleHandleA
GetProcAddress

user32

CharNextA

advapi32

RegCloseKey

oleaut32

SysFreeString

version

VerQueryValueA

gdi32

SaveDC

ole32

CoTaskMemFree

comctl32

ImageList_Add

ws2_32

send

wsock32

send

msvcrt

_gcvt

shell32

SHGetMalloc

Sections

.MPRESS1
Size: 333KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE