NEAS[.]4d417c528907e1b57d3bbfccfae16e80[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.4d417c528907e1b57d3bbfccfae16e80.exe
Size

132KB
MD5

4d417c528907e1b57d3bbfccfae16e80
SHA1

9e724c85b90481fbc872f35f07c5ea01f2c94458
SHA256

427a89619afa5e562547d0e9371f2e789b3f77b79385640052c4295566bbd05d
SHA512

79443885cc6f28a493235847f652fbb2c25915fe9126fa038bec951b4ec83f90fc16bc1629c02ad80bd0618f065a171900b9a546b40a9fe7a65af14c6d2c0e4d
SSDEEP

3072:xvFUa0b8w7wTKGR5qoFKnaymV/atYdkGT0CUuS4hsD4ruww:xvFUfITHkLMLss5w

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.4d417c528907e1b57d3bbfccfae16e80.exe

Files

NEAS.4d417c528907e1b57d3bbfccfae16e80.exe
.exe windows:5 windows x86

d40391ee5183450092ed26706cbedad8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

user32

EndPaint

gdi32

SetBkColor

advapi32

RegOpenKeyW

msvcrt

exit

Sections

.MPRESS1
Size: 125KB - Virtual size: 360KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 552B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE