NEAS[.]e9e9b12beb421fbb5be604ccdada98b0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.e9e9b12beb421fbb5be604ccdada98b0.exe
Size

1.3MB
MD5

e9e9b12beb421fbb5be604ccdada98b0
SHA1

a7db3e09fc5073a05f120a5763f453f4e7acf06e
SHA256

d0852a94122eb181dac17c37ece713da024517366d54561cca046a5ed23737fc
SHA512

3f6f72f03f21005a612f2f52d7c0022473bb27ab5a1ef3e86f77dc98cff9561af706941e5bb34ce149422e0fff61c184943873bfc884a3f1bce764744816ca5f
SSDEEP

6144:ZsN+QhAPai5tHr/MxHqnP3tCEr89EsbD62Z+w4VoH46hMKPX:W5hAPjPHr/wiPkEr89Eogw4VoH4cj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.e9e9b12beb421fbb5be604ccdada98b0.exe

Files

NEAS.e9e9b12beb421fbb5be604ccdada98b0.exe
.exe windows:5 windows x86

6d1f028787ecd18f946abf29ae022207

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetProcAddress
VirtualAlloc
VirtualFree
VirtualProtect

user32

EndPaint

advapi32

RegCloseKey

shell32

ShellExecuteA

iphlpapi

GetAdaptersInfo

ws2_32

htonl

wtsapi32

WTSRegisterSessionNotification

Sections

.text
Size: 65KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 443KB - Virtual size: 623KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Khsgd
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE