NEAS[.]00bf1baa971ed2597430b2811e192ce0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.00bf1baa971ed2597430b2811e192ce0.exe
Size

493KB
MD5

00bf1baa971ed2597430b2811e192ce0
SHA1

b02fc8336626a392e8bd3ee186fefc40af1aa495
SHA256

de320404f6c32412881f216e20e404248c9f46f0c9fca277c9965bd1968add15
SHA512

1127c95ff3c1c3a067f576cd5e38729b249130714fa6f35ecbf97e293bcc29fceed805538a4227904fa46aaefd38188af83c4eeae2b9e41cf82fb74efe00bc23
SSDEEP

12288:lgDOMn3Dz4V3KLof0pX5g9lcCiQwPRhedoS524h7FXAvwCIs:lgOqK0d5ecDrahAvD9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.00bf1baa971ed2597430b2811e192ce0.exe

Files

NEAS.00bf1baa971ed2597430b2811e192ce0.exe
.exe windows:4 windows x86

c237fe786ece3938857fc6431cb96526

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

OleLoadPictureFileEx

advapi32

AddAccessAllowedAce

user32

GetMessagePos
GetProcessWindowStation

kernel32

GetCurrentProcessId

Sections

.text
Size: 486KB - Virtual size: 488KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 294B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE