NEAS[.]4ea51b4422c365be914eecd62a4213e0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.4ea51b4422c365be914eecd62a4213e0.exe
Size

170KB
MD5

4ea51b4422c365be914eecd62a4213e0
SHA1

04d6eb1d7cfb6f420ea7ff6495a8b5e8bce1dde2
SHA256

9ecc33668c2ea69cee951f58e1097cdb97950b355d85af682a85c38b55d5ec89
SHA512

069ed99c9999d2b4e55c356faca90196490a36e95d90135a550650846fa3db8677021614ad5aa2f5ef74921bcf2963e6004169cf10780bb1e11dbd1389ce5077
SSDEEP

1536:s9SsmEuUQ0/Siir+jJuCGEvkznmP+upxEJcoLN4LZ8BSaPXDew:uT/NbGEv8mWupxEKoBuiB/XDR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.4ea51b4422c365be914eecd62a4213e0.exe

Files

NEAS.4ea51b4422c365be914eecd62a4213e0.exe
.exe windows:4 windows x86

b52f1898b4b003f762f5b9c03e005e8a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

wsprintfA
MessageBoxA
GetClassNameA
IsWindowVisible
GetAsyncKeyState
GetWindow
GetWindowThreadProcessId

kernel32

ReadFile
LCMapStringA
LoadLibraryA
FreeLibrary
Sleep
GetLocalTime
GetStartupInfoA
CreateProcessA
OpenProcess
GetModuleHandleA
GetProcAddress
ReadProcessMemory
CreateRemoteThread
VirtualFreeEx
CloseHandle
WaitForSingleObject
GetExitCodeThread
VirtualProtectEx
WriteProcessMemory
CreateToolhelp32Snapshot
Module32First
CreateThread
OpenEventA
CreateEventA
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
WriteFile
GetFileSize
CreateFileA
MoveFileA
DeleteFileA

msvcrt

malloc
_CIfmod
_CIpow
strchr
realloc
memmove
__CxxFrameHandler
sprintf
strncpy
atoi
??3@YAXPAX@Z
strncmp
??2@YAPAXI@Z
modf
_ftol
free

Sections

.text
Size: 151KB - Virtual size: 151KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 672B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ