NEAS[.]c05e0d8a22d308e198e8a22241d15760[.]exe | Triage

Sharing

General

Target

NEAS.c05e0d8a22d308e198e8a22241d15760.exe
Size

33KB
MD5

c05e0d8a22d308e198e8a22241d15760
SHA1

2f78ad4693a701d7bc792d2bd6c04f6651fa8e05
SHA256

fa81c62a053e46662e6d97e934e3cb674416bdb75b0bf8f4f8bcb2c10ec93ead
SHA512

300b2af8e9903f564fed882f120261c463f6924ef9b3546aaaedbd0a4b7d39023db4d9962de2efb12e67e7eb49c58d2268192930a0a6803b20605ccfccbb141a
SSDEEP

384:2Mv0aVJOt2obD3/HhzF8N+HBnFIy+YPe6xagk58sCub2bmqgUCEj0odhYgcHfvPM:373OtJDvhzNsyXk58sCuS3g69dKxvKr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.c05e0d8a22d308e198e8a22241d15760.exe

Files

NEAS.c05e0d8a22d308e198e8a22241d15760.exe
.exe windows:5 windows x86

bbc712c81dbe5f313d887223f25de84e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleW
GetStartupInfoW
RtlUnwind
DecodePointer
EncodePointer
EnterCriticalSection
ExitProcess
GetACP
GetCPInfo
GetCurrentProcess
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetOEMCP
GetProcessHeap
GetSystemPowerStatus
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
OutputDebugStringW
SetLastError
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualAlloc
VirtualFree
VirtualProtect

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ