NEAS[.]65c4f51af442e5d160e9491e768e62a0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.65c4f51af442e5d160e9491e768e62a0.exe
Size

253KB
MD5

65c4f51af442e5d160e9491e768e62a0
SHA1

9e85ec55a5599fa0101dbb4b571abd7bf5541bd0
SHA256

0dc010e9958a18230b5426ffdc18133796753d323d6f15d0363fab424e1a4b34
SHA512

9d0f58f43f2268c44cad3c80b4388ec88b4aecc1ca988eee5d571cc40e1cce2359cdfd108cc392e0cc47b09bf0cf99f8b414472006ad4e9c37e0fe1ad036c82b
SSDEEP

6144:Pb41nDY6RZ+Pl9Mx0BeY6LCMXRdveOqvQ2w9Z4:P8dZ6Mx0UYRMXDveDQ2+4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.65c4f51af442e5d160e9491e768e62a0.exe

Files

NEAS.65c4f51af442e5d160e9491e768e62a0.exe
.exe windows:1 windows x86

5e01feb0c8712b4079282e56efc8078d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
LoadLibraryExA
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
lstrlenA
CreateFileA
GetModuleFileNameA

ntdll

RtlLengthSid
RtlInitUnicodeString
RtlFreeHeap
RtlAllocateHeap

advapi32

RegOpenKeyExA
LsaClose
RegSetValueExA
RegQueryValueExA
RegCloseKey
LsaOpenPolicy

ulib

?GetLexeme@ARGUMENT@@QAEPAVWSTRING@@XZ
??0DSTRING@@QAE@XZ
??0PATH@@QAE@XZ
??0STRING_ARGUMENT@@QAE@XZ
??0ARRAY@@QAE@XZ
??0ARGUMENT_LEXEMIZER@@QAE@XZ
??1PROGRAM@@UAE@XZ
?ValidateVersion@PROGRAM@@UBEXKK@Z
?Usage@PROGRAM@@UBEXXZ

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_MEM_READ