NEAS[.]6a1fda5dc4c511945d523305f3c1c506[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.6a1fda5dc4c511945d523305f3c1c506.exe
Size

132KB
MD5

6a1fda5dc4c511945d523305f3c1c506
SHA1

f4fad4e8366d73df33c7bcf4694413aa1a0ffe5d
SHA256

bab8de8d86f7b13972bc6e4791c1366e88b8884498ff504bbedfa86b32f70cb9
SHA512

f1c904f1568f63e58077dd46cc2484001a008e9a30ad979d252563025887b3cd0bf355efab5864c41c0b1d79d16404cf0dd63112f064ff95d9b315d1d6f9e0ee
SSDEEP

1536:gzBoJqH5LY2jTb0I+F+a487QbEkv2q6PWdTBOilPyw3LrwztEi1Hep/LBh2yEi9C:guWjTbqRkv2U5Py6LJlBh1Eimn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.6a1fda5dc4c511945d523305f3c1c506.exe

Files

NEAS.6a1fda5dc4c511945d523305f3c1c506.exe
.exe windows:4 windows x86

660a54738a98c23ef022b9f08c7e2823

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WinExec
GetModuleFileNameA
GetTempPathA
GetModuleHandleA
GetStartupInfoA

urlmon

URLDownloadToFileA

msvcrt

srand
time
rand
fclose
sprintf
fwrite
fopen
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
exit

Sections

.text
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 722B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 84KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ