NEAS[.]aa38dd77b41a4ad66bb75a8899918170[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.aa38dd77b41a4ad66bb75a8899918170.exe
Size

13KB
MD5

aa38dd77b41a4ad66bb75a8899918170
SHA1

f75c1d596aa3a7273e76f3cf5850ca450744b5db
SHA256

79f85d24286d33373bfd422054698589335a2b0abe43d24f9fc22ab52e229320
SHA512

a26b11738b2ccb53d725ef78e6d4455a17412fe891d3d030ac9737ba2c4135eaa4f432bc160276de4891ff92573f7ab9b81c8d8ced6e4cc22b1867957dd654ad
SSDEEP

96:X53qgNbQB0R7a8TuMuSkoWdJuqJpuysghSzlr/sEb/TnIL81ZZUys3/SG9XCDPsz:X5agNOuavry0Kt7nIyZZUv/TyDPs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.aa38dd77b41a4ad66bb75a8899918170.exe

Files

NEAS.aa38dd77b41a4ad66bb75a8899918170.exe
.dll windows:6 windows x64

d1e8f80f00a19e212abb1df988dbacac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

libapriconv-1

apr_iconv_mod_noevent

kernel32

RtlLookupFunctionEntry
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent

vcruntime140

__std_type_info_destroy_list
memset
__C_specific_handler
memcpy

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table
_cexit

Exports

Exports

iconv_module

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ