NEAS[.]be85c459367dcf8820f6e157003f9440[.]exe

General

Target
NEAS.be85c459367dcf8820f6e157003f9440.exe
Size 600KB
Sample231101-rmqapsha45
SHA256 08a41e52deaddd2b456b45c90db95a7ca6e619ae9ed696336729bafd24b71638
MD5 be85c459367dcf8820f6e157003f9440
SHA1 542c7b6c0af483b61395044f31b922ec8a2dfdf8
SHA512 d7b997c4765bf7694c772aa72825217836473e7d3d4db434bedbd6c4f445c65df5b1f974c8fe0fae864adca89f0eb3e26c97a6fe891e71e6532c02aff3bb8f54
SSDEEP 12288:zJB0lh7r6bIjk0aCyxI8Yhm46LchjBhIVHSJaFCu:zQ7W8QaTrjAVHhCu
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.be85c459367dcf8820f6e157003f9440.exe

File Explorer

NEAS.be85c459367dcf8820f6e157003f9440.exe

.exe 600KB

NEAS.be85c459367dcf8820f6e157003f9440.exe

IMPHASH 58471b8a9f8702d1a9e4838d7b7d501a
SHA256 08a41e52deaddd2b456b45c90db95a7ca6e619ae9ed696336729bafd24b71638
MD5 be85c459367dcf8820f6e157003f9440
SHA1 542c7b6c0af483b61395044f31b922ec8a2dfdf8
SHA512 d7b997c4765bf7694c772aa72825217836473e7d3d4db434bedbd6c4f445c65df5b1f974c8fe0fae864adca89f0eb3e26c97a6fe891e71e6532c02aff3bb8f54
SSDEEP 12288:zJB0lh7r6bIjk0aCyxI8Yhm46LchjBhIVHSJaFCu:zQ7W8QaTrjAVHhCu
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5064

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

oleaut32

SysFreeString SysAllocStringLen SysAllocStringByteLen SysStringLen

user32

LoadStringW WaitMessage

kernel32

GetProcAddress VirtualAlloc VirtualProtect GetStartupInfoW RtlMoveMemory WideCharToMultiByte SetFileApisToOEM GetModuleHandleW SetFileApisToANSI GetUserDefaultLCID

msvbvm60

__vbaVarSub _CIcos _adj_fptan __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaVarIdiv __vbaFreeVarList _adj_fdiv_m64 __vbaVarFix _adj_fprem1 __vbaHresultCheckObj _adj_fdiv_m32 __vbaAryDestruct __vbaVarForInit __vbaVarPow __vbaObjSet _adj_fdiv_m16i _adj_fdivr_m16i ord706 __vbaBoolVarNull _CIsin __vbaChkstk EVENT_SINK_AddRef __vbaGenerateBoundsError __vbaVarOr __vbaRedimPreserve _adj_fpatan __vbaRedim EVENT_SINK_Release __vbaUI1I2 _CIsqrt EVENT_SINK_QueryInterface __vbaUI1I4 __vbaVarMul __vbaExceptHandler _adj_fprem _adj_fdivr_m64 __vbaVarDiv __vbaFPException __vbaUbound __vbaStrVarVal _CIlog __vbaErrorOverflow __vbaVar2Vec __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaFreeStrList _adj_fdivr_m32 __vbaR8Var _adj_fdiv_r ord100 __vbaI4Var __vbaVarCmpEq __vbaAryLock __vbaVarAdd _CIatan __vbaStrMove _allmul _CItan __vbaAryUnlock __vbaVarForNext _CIexp __vbaFreeStr __vbaFreeObj ord581

Sharing