NEAS[.]c520d8c0f26f6c5ed3c7f44400452ad0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.c520d8c0f26f6c5ed3c7f44400452ad0.exe
Size

20KB
MD5

c520d8c0f26f6c5ed3c7f44400452ad0
SHA1

f384f05627830bd81819e670dc8286f004097903
SHA256

fa81d843eaa5e65e32bbe09f7ff6f25213ba3cee901ac8ac71e4c7c1adc91c4c
SHA512

f9f997250ea35f268c5a04e3addb335925636d6aefc64e23a4fe575405b14e0d7b20de6ed940e3f6d5d2ddc4efeab6ec97ca48346804ba8c3c6d2d2aaa97c8ec
SSDEEP

384:zXZIwIhWgw7cfyL010cXXVHuO8kg5zy7ZTu2wb7OaCz2k1+bYhzg:zXZywcllHuO8k17gXPOP2k1+bYhg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.c520d8c0f26f6c5ed3c7f44400452ad0.exe

Files

NEAS.c520d8c0f26f6c5ed3c7f44400452ad0.exe
.exe windows:4 windows x86

f0c0a52023ddf031f7d5cc1b2b52c624

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

EnterCriticalSection
VirtualProtect
InitializeCriticalSection
GetModuleHandleA
HeapAlloc
GetProcessHeap
TerminateProcess
VirtualAllocEx
HeapFree
VirtualAlloc
lstrlenA
GetLastError
LockResource
lstrcpyA
SizeofResource
FindResourceA
WritePrivateProfileStringA
GetTempPathA
CloseHandle
WriteFile
SetFilePointer
ExitProcess
ReadFile
GetFileSize
CreateFileA
CopyFileA
GetModuleFileNameA
lstrcatA
GetProcAddress
LoadResource
LeaveCriticalSection

advapi32

CryptGenRandom
CryptReleaseContext
CryptAcquireContextA

Exports

Exports

szFile

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 927B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ