NEAS[.]000cb3b6ee40d04b51fb96264c80ca60[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.000cb3b6ee40d04b51fb96264c80ca60.exe
Size

42KB
MD5

000cb3b6ee40d04b51fb96264c80ca60
SHA1

65b3ed9f91b278a4147ef14fcf5b7bacd222975b
SHA256

37bbd5b3d4dbb474fa5c1af9177c83e2a91b36849d1af9dd978d3a80456d4143
SHA512

f4983ac05ba5b66285c9899890f8b9420c1c0725f923b2916d903e3d110f10f5cf7a209f2828abf12e73c39ef59e596da1a66adfa718297aabd2c744ab77b4b2
SSDEEP

768:rg+gi/tfhKfitqTqN+gj4cPNUpmVLq6Vfm8NfA7oWfU/KjUDELDLjprN1:FgAjkat9f/NorfUcUoXprL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.000cb3b6ee40d04b51fb96264c80ca60.exe

Files

NEAS.000cb3b6ee40d04b51fb96264c80ca60.exe
.exe windows:5 windows x86

5900068b46e9a58eb0bafafafe2f6fb2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__initenv
_cexit
_XcptFilter
_exit
_c_exit
sprintf
setlocale
printf
exit
wprintf

advapi32

RegSetValueExW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW

kernel32

SetThreadLocale
GetCurrentProcess
GetProcessAffinityMask
GetUserDefaultLCID
SetThreadAffinityMask
GetVersionExW
FormatMessageW
GetConsoleOutputCP
SetConsoleOutputCP
GetOEMCP
GetCurrentThread
GetModuleHandleA

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 37KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

bgkurrn
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE