NEAS[.]60d327d161cd2d1b4e0aac6dccbc9db0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.60d327d161cd2d1b4e0aac6dccbc9db0.exe
Size

208KB
MD5

60d327d161cd2d1b4e0aac6dccbc9db0
SHA1

e7641d5d4db479420b406a31f0546598265ca965
SHA256

c8aabcdface4b4a2500b86d2da1309276cd8b7ca9bea6187badbe61e1629e375
SHA512

c1ea386fc436f38432dd988ee6b9910b0e4473e9d0aa3676dbabea8e9e81cb8867ca58ea6d36967db9646d7b2f19b39976613abb9c3b7c75f6c9b1f73667fa55
SSDEEP

6144:Dl1Dw9SWqWBXdZ+eELpEhcMJNgCK0l1/1r5:LDw9TqOdceEDM4CKeB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.60d327d161cd2d1b4e0aac6dccbc9db0.exe

Files

NEAS.60d327d161cd2d1b4e0aac6dccbc9db0.exe
.exe windows:4 windows x86

691f1193f16065947032ace3a2329e55

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

msvcrt

fabs

comctl32

InitCommonControls

user32

IsChild

gdi32

BitBlt

ole32

CoInitialize

shell32

ShellExecuteExA

shlwapi

PathQuoteSpacesA

Sections

.MPRESS1
Size: 203KB - Virtual size: 752KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE