NEAS[.]b9afe2953368f30e6208b0f58f276240[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.b9afe2953368f30e6208b0f58f276240.exe
Size

44KB
MD5

b9afe2953368f30e6208b0f58f276240
SHA1

7e121d514aa8d87866d735465574243fe111b3a7
SHA256

51f316c2217a45503bf98ab751235fd6620dbba03ab7eb5c679859d3eb7d9aa0
SHA512

49e53e58570ca95775939c989f4724141e0ca23b5fa1b77acb2c51893fd6552cca1a78cc9a04cd76bb9029048b4c1c74f831c2a137a8252ec4fe7519fa66cf6d
SSDEEP

768:373OtJDvhzNsyXk58sCuSw26e1OfF0zx5M3ycg6:3a/DvVNe58kSw2t18Cd5Mi56

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.b9afe2953368f30e6208b0f58f276240.exe

Files

NEAS.b9afe2953368f30e6208b0f58f276240.exe
.exe windows:5 windows x86

bbc712c81dbe5f313d887223f25de84e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleW
GetStartupInfoW
RtlUnwind
DecodePointer
EncodePointer
EnterCriticalSection
ExitProcess
GetACP
GetCPInfo
GetCurrentProcess
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetOEMCP
GetProcessHeap
GetSystemPowerStatus
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
OutputDebugStringW
SetLastError
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualAlloc
VirtualFree
VirtualProtect

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ