NEAS[.]f9a87e88d4f51fdfc4b92088ec5e5000[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.f9a87e88d4f51fdfc4b92088ec5e5000.exe
Size

132KB
MD5

f9a87e88d4f51fdfc4b92088ec5e5000
SHA1

dbef4b209b88f39d4cbaabda355dfdb9f801f044
SHA256

5f3bfcf9b50887f325df64799e11b5c57bb5b7a054db1fb903b807770acfa161
SHA512

748e0cc74c6993f121efe3cc8449c4d208f12b1304b64ca3fd3b9413c4a8a396e2f394426369dc11f2f129254dbb57c9b6bbfb671be484d2529be7a96ca36409
SSDEEP

3072:xvFUa0b8w7wTKGR5qoFKnaymV/atYdkGT0CUuS4hsD4ruwk:xvFUfITHkLMLss5k

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.f9a87e88d4f51fdfc4b92088ec5e5000.exe

Files

NEAS.f9a87e88d4f51fdfc4b92088ec5e5000.exe
.exe windows:5 windows x86

d40391ee5183450092ed26706cbedad8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

user32

EndPaint

gdi32

SetBkColor

advapi32

RegOpenKeyW

msvcrt

exit

Sections

.MPRESS1
Size: 125KB - Virtual size: 360KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 552B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE