NEAS[.]3a9ad48d37db8e6932fcd436c03c6080[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.3a9ad48d37db8e6932fcd436c03c6080.exe
Size

1.6MB
MD5

3a9ad48d37db8e6932fcd436c03c6080
SHA1

87e7d38c568c56112a659009dfe5406457cdf897
SHA256

222b65da76a0cbd5a8f828666672aff3fdf760cbf88474fe7f6974d9ebe13d34
SHA512

06e9011b8860892b25783ec6c9dd18553017f46c1ff7b61d5ab468aefac490fdc11eff2fe162e34bc40f1870f526e3211d70d43c032663f1b767891e2778af0a
SSDEEP

24576:h5EqwrtLZOCmWock5JWANMp2LJzrcxINag0JkzLeWAJKTaiybS7V:huMIo48Nox8jlz2Sx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.3a9ad48d37db8e6932fcd436c03c6080.exe

Files

NEAS.3a9ad48d37db8e6932fcd436c03c6080.exe
.dll windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

CloseHISDatabase_6015
ConnectHISDatabase_6015
CreateProject_6015
DelItemPerson_6015
DelPersonAllInfo_6015
PayPersonToTeam_6015
PayPerson_6015
PayTeam_6015
PayTeam_JZ_6015
ReadPatInfoByCardNo
RefundByItems_6015
ResendPayPerson_6015
UnPayTeam_6015
UnPayTeam_JZ_6015
UpdatePersonAndItemRebate_6015

Sections

CODE
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 497B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ