NEAS[.]72f263965eef68bd3612c1f5b2b84d10[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.72f263965eef68bd3612c1f5b2b84d10.exe
Size

85KB
MD5

72f263965eef68bd3612c1f5b2b84d10
SHA1

00ec5351ad807a5f39fe661f37cbdb48b92c3a2b
SHA256

dd96a6ecf6cd8a825299b0a9a8ec02122cbd7b564c4fe780757e76748872d244
SHA512

ab5888726334429a1eb7fb066163d8b9df4d86cfe783d781c76cc590ea346b0c7afe6328dc8993b8b4e5346f564f0833c3ec691c3a33bc3412c95843bfb257e0
SSDEEP

96:npTlyPB8dcfnp3hWvUSaiUnhEqvQg6Pk5JwdsBd:1PYpeai6hPskJr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.72f263965eef68bd3612c1f5b2b84d10.exe

Files

NEAS.72f263965eef68bd3612c1f5b2b84d10.exe
.exe windows:5 windows x86

d0b8285184365a838ba34f4f2ef57766

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

wininet

InternetSetOptionW
HttpSendRequestW
InternetConnectW
InternetReadFile
HttpQueryInfoW
HttpOpenRequestW
InternetQueryOptionW
InternetOpenW

kernel32

HeapCreate
GetModuleFileNameW
DeleteFileW
CloseHandle
GetCurrentDirectoryW
GetTempPathW
lstrlenW
lstrcmpW
ExitProcess
GetFileSize
HeapAlloc
GetModuleHandleW
WriteFile
ReadFile
CreateFileW

user32

wsprintfW

shell32

ShellExecuteW

Sections

.MPRESS1
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE