NEAS[.]db291ca3a8041535c4930112542c4010[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.db291ca3a8041535c4930112542c4010.exe
Size

315KB
MD5

db291ca3a8041535c4930112542c4010
SHA1

525b674016b2bed2b3115f5af85291811673e83d
SHA256

b6d0dc8a2994eaf4231e56ad4c59b85cf1242c76ab93ef90171a60632b3b8e21
SHA512

ec925510f7409d3f1dd6e5d07885af4ce5f525981861573ee5066d4644e6b6b2a68e3e822eee1ad6021a250b5ab2f5e921fc3a5542f1749c37703363f67f8d7d
SSDEEP

6144:HIJsyBGAEiQPBVRzPivYJoBuYXb94oIMdd8vfZ50Mhibw4OiA:BVAWNDTJHq9DIMTW8c1iA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.db291ca3a8041535c4930112542c4010.exe

Files

NEAS.db291ca3a8041535c4930112542c4010.exe
.exe windows:5 windows x86

3b3ca5844bdb8b6b333c1e673e18f1c8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetProcAddress
VirtualAlloc
VirtualFree
VirtualProtect

user32

GetDC

advapi32

RegCloseKey

shell32

ShellExecuteW

ws2_32

gethostbyaddr

iphlpapi

GetAdaptersInfo

oleacc

LresultFromObject

gdi32

SaveDC

winspool.drv

OpenPrinterW

oleaut32

VariantClear

Sections

IOKGDTTY
Size: - Virtual size: 488KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

IOKGDTTY
Size: 309KB - Virtual size: 312KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE