NEAS[.]df86366540f81d12b232e4a7d4385f80[.]exe | Triage

Sharing

General

Target

NEAS.df86366540f81d12b232e4a7d4385f80.exe
Size

1.0MB
MD5

df86366540f81d12b232e4a7d4385f80
SHA1

80b7d426492d5a2eb4f4324db0ec63f36bc362b5
SHA256

d3fc3c5cfa32cfb7e6252e1a3c2d462d82dbfa5e629ab5055ac8a2ae90d8b5bf
SHA512

8083c9dbf04ad1f3ca1c00b5b54c79951b6a1597f5d77bd2307f5b36f6ef4717c6ea11ea5a4ef529bf046c0804de0928b53cc6fd03501b8f80f3f8f70e6658e8
SSDEEP

24576:oGly/X022DbKNE+OQgE9/Y5FiLA5d77QktAru:o/X02u0Y5FiLg77

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.df86366540f81d12b232e4a7d4385f80.exe

Files

NEAS.df86366540f81d12b232e4a7d4385f80.exe
.dll windows:4 windows x86

51e8527653d57c846656a640f604f55a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

rasapi32

RasHangUpA

user32

SetClipboardData

gdi32

SaveDC

winmm

midiOutReset

winspool.drv

DocumentPropertiesA

advapi32

RegQueryValueA

shell32

ShellExecuteA

ole32

CoTaskMemAlloc

oleaut32

VarDateFromStr

comctl32

ImageList_Read

ws2_32

accept

wininet

InternetCloseHandle

comdlg32

GetFileTitleA

Exports

Exports

HuaxiaVolcanoInstall

Sections

.text
Size: 1016KB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE