NEAS[.]899ecfe008cd827895c8860bd30debd0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.899ecfe008cd827895c8860bd30debd0.exe
Size

138KB
MD5

899ecfe008cd827895c8860bd30debd0
SHA1

f92a95a654b129606b7082223df009ad4feb5408
SHA256

78a9b9b10316599664094065282e4c79031f54e65ee6648f91d79c432c391230
SHA512

7fd58dcb7165724c9037bc86f3672da941ff1468e91a25715eb6e586f6e265756f74193635f8463d0ab0e6d3400fde48079824f9d15345bd4bc21317b01bf5e0
SSDEEP

3072:9hlkUC7wGnLduIVs/wGD0WQubZ0Bbm7HWKlrreiBDcT:9DkIGn8IVODChBSbWKl1DcT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.899ecfe008cd827895c8860bd30debd0.exe

Files

NEAS.899ecfe008cd827895c8860bd30debd0.exe
.exe windows:1 windows x86

214a4fdc45b1e49eaeb17c7ca1b86e49

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
GetModuleHandleA
GetProcAddress
GetTempPathA
LoadLibraryA
RtlUnwind
CreateFileA
CreateFileMappingA
VirtualProtect
lstrcpyA
CloseHandle
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoA
lstrlenA
GetVersionExA
GetSystemDirectoryA
CreateEventA
OpenProcess

crtdll

__GetMainArgs
exit
raise
signal

psapi

EnumProcesses

advapi32

RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegCloseKey
OpenProcessToken
FreeSid
AllocateAndInitializeSid

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 125KB - Virtual size: 364KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 384B - Virtual size: 384B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ