NEAS[.]68c2b083f3c16e4de3d544e46f327a90[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.68c2b083f3c16e4de3d544e46f327a90.exe
Size

221KB
MD5

68c2b083f3c16e4de3d544e46f327a90
SHA1

f6a51e397b8cc97b33356b2dada3ff827c8232c3
SHA256

52282bf6fd59cc3a51cf2e6200f92c1f0f0e998b358a89a41cc9d21435da73f4
SHA512

fbc41f48c8f3deb5b998211f52703884814f7c020e9ebd6e208436eda0d70e2cf6c39b7e9d55387cf1a41ba1501acfb691cb52f763f15bde4c2bd61086658479
SSDEEP

3072:FLhgj1KiLc3OIkSCiuYyIyu99eQH6v5pBzD05y5zU7H/Gv+hkkzT:FVa1KiLu/knijyIZ9V6v5jo5y5afIkzT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.68c2b083f3c16e4de3d544e46f327a90.exe

Files

NEAS.68c2b083f3c16e4de3d544e46f327a90.exe
.exe windows:5 windows x86

5fb34ba92ec7f5f859e799eccd01683c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

TranslateMessage

gdi32

DeleteObject

advapi32

OpenProcessToken

shell32

ShellExecuteW

ws2_32

WSAStartup

Sections

.text
Size: 186KB - Virtual size: 600KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE