NEAS[.]0f6c954bf7392e3bb77af54cf45ec350[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.0f6c954bf7392e3bb77af54cf45ec350.exe
Size

149KB
MD5

0f6c954bf7392e3bb77af54cf45ec350
SHA1

0c9228655ebbbbb8ae4f26510f6ed0f7373ceeba
SHA256

c6f43d14fcb43b5ba1bdcdff16091a79d0c05bde3e47e2463b9640fff8f6127b
SHA512

27583688121eca5fca07670324fdec4f9da3b67fa5aff4d1406b24ab9050e5d53b7d0712510fa72975cbe0de2fbc073861f912335c29c2705e8a7aa8b08bea29
SSDEEP

3072:P3BVuOiuZyDmbAdX2mqIJs++lFoMiquC4BBeBiN7l2w:Pbu1nDY6XlvUFoY0BeY6w

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.0f6c954bf7392e3bb77af54cf45ec350.exe

Files

NEAS.0f6c954bf7392e3bb77af54cf45ec350.exe
.exe windows:1 windows x86

5e01feb0c8712b4079282e56efc8078d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
LoadLibraryExA
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
lstrlenA
CreateFileA
GetModuleFileNameA

ntdll

RtlLengthSid
RtlInitUnicodeString
RtlFreeHeap
RtlAllocateHeap

advapi32

RegOpenKeyExA
LsaClose
RegSetValueExA
RegQueryValueExA
RegCloseKey
LsaOpenPolicy

ulib

?GetLexeme@ARGUMENT@@QAEPAVWSTRING@@XZ
??0DSTRING@@QAE@XZ
??0PATH@@QAE@XZ
??0STRING_ARGUMENT@@QAE@XZ
??0ARRAY@@QAE@XZ
??0ARGUMENT_LEXEMIZER@@QAE@XZ
??1PROGRAM@@UAE@XZ
?ValidateVersion@PROGRAM@@UBEXKK@Z
?Usage@PROGRAM@@UBEXXZ

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_MEM_READ