NEAS[.]bd90740609e33e6db1fb1af3a610a960[.]exe | Triage

Sharing

General

Target

NEAS.bd90740609e33e6db1fb1af3a610a960.exe
Size

104KB
MD5

bd90740609e33e6db1fb1af3a610a960
SHA1

6b8577036a1629778f4a81c81ee8dfd302532278
SHA256

ecc3bb84f2f20800903d95ad732d6de07566602870da609ee2b9feb142ec2cad
SHA512

25bc5d693eb55a9aafd1f3ff2da84801a4e037f52b55ccbc0a57c19ecd4c32a77943bcbac478e41a6434c5ea2dc73c099ed457b3a22b83de2c5cefc4ae230901
SSDEEP

384:ZoYprlBYprDaiMXYaymDvjvNspS7x7XP2S7D8o97bAN:ZoalBaDaJvymASx+m197bW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.bd90740609e33e6db1fb1af3a610a960.exe

Files

NEAS.bd90740609e33e6db1fb1af3a610a960.exe
.exe windows:5 windows x86

d0b8285184365a838ba34f4f2ef57766

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

wininet

InternetSetOptionW
HttpSendRequestW
InternetConnectW
InternetReadFile
HttpQueryInfoW
HttpOpenRequestW
InternetQueryOptionW
InternetOpenW

kernel32

HeapCreate
GetModuleFileNameW
DeleteFileW
CloseHandle
GetCurrentDirectoryW
GetTempPathW
lstrlenW
lstrcmpW
ExitProcess
GetFileSize
HeapAlloc
GetModuleHandleW
WriteFile
ReadFile
CreateFileW

user32

wsprintfW

shell32

ShellExecuteW

Sections

.MPRESS1
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE