NEAS[.]9aca1e1d794da83972d287d9de7aad20[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.9aca1e1d794da83972d287d9de7aad20.exe
Size

170KB
MD5

9aca1e1d794da83972d287d9de7aad20
SHA1

27837e48d61e5c3d4b8753ff693958a3562e4e13
SHA256

067d6476631d8c6766e45a6b06bb1d7e8dac4e4aec93b9adbd4c9360c2286cb6
SHA512

b0cdc1a76a3e6a58edbce5cab97ced112a771fee19d19eaa77fb00c581d264c097fa7641972cbd42895835e20e5f12e800d867931735b2deac83b6bbaef63dd9
SSDEEP

3072:Wbg/Zb5iCiXYteEp/tJzRgWf1hGLi0BCxAlJyRGQCfeypNfzSeKkCcip:vBdiDIFJ/zRr1gLi4BlJyJC2yp4e9ip

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.9aca1e1d794da83972d287d9de7aad20.exe

Files

NEAS.9aca1e1d794da83972d287d9de7aad20.exe
.exe windows:1 windows x86

b182e386c09eced3853648b178cfc1ae

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CryptBinaryToStringW

kernel32

GetProcAddress
LoadLibraryA
RtlUnwind
VirtualProtect
InterlockedCompareExchange
GetModuleHandleA
CloseHandle
Sleep
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoA
GetLastError

crtdll

__GetMainArgs
exit
raise
signal

advapi32

RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegCloseKey

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 150KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 204B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE