NEAS[.]dd5eb6dcf49525efc7e9ae5e82187c40[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.dd5eb6dcf49525efc7e9ae5e82187c40.exe
Size

119KB
MD5

dd5eb6dcf49525efc7e9ae5e82187c40
SHA1

366cbb1f2c973b19e8b80045e78e7d30d0713813
SHA256

6a1d3dd451eaa3c243b80a24f24ad8fc5a8835283a079f1690885b1b29e9c866
SHA512

dbb99266016042e4cb4ee9f6c11c348a29fde58dcc8989ef125eccc35e6dfc4dde575e0f546e5841f19e8bd3a310d6106a9aabdc0c46cc02000c9c3c9faf42a9
SSDEEP

3072:3ZTpSDhvgHzQIOwj1VZ4vrMvxcrYmXokL2OKAxC:JlIqUlwjt4jCxcrLXou2OKAxC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.dd5eb6dcf49525efc7e9ae5e82187c40.exe

Files

NEAS.dd5eb6dcf49525efc7e9ae5e82187c40.exe
.exe windows:4 windows x86

239dbddffaead5d92bbd23847846001c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseState
VirtualUnlock
GetCurrencyFormatA
FindFirstVolumeW
GetGeoInfoEx
GetCurrencyFormatEx
BaseQueryModuleData
RegDeleteKeyExA
RegisterWowExec
RegSetValueExW
WerpInitiateRemoteRecovery

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE