NEAS[.]0efc78fcfdf2bcecce617d838640c8a0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.0efc78fcfdf2bcecce617d838640c8a0.exe
Size

112KB
MD5

0efc78fcfdf2bcecce617d838640c8a0
SHA1

fc4d7910f4d9f067408112e9f546161f3369571c
SHA256

d947a2cc79e2a77813e19fa8700cc03571a96c841dd3962bc48302e0d1ef3673
SHA512

f48d8a480b947db6d401cec222387e4a63d5dc1e1dc7303848f997e91e8ebf91468707e39bcfabda34d099caa1947c9be7ccaff3d8c599995220be25659d7688
SSDEEP

3072:bigRqGiY/IA8wD5iZ4gKczBxGV6+UIXlaMA+uzlCa:yw/IFwDox+UGg5XzlCa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.0efc78fcfdf2bcecce617d838640c8a0.exe

Files

NEAS.0efc78fcfdf2bcecce617d838640c8a0.exe
.exe windows:1 windows x86

7aa54ce8454f118e02c919266ff521f2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

iphlpapi

GetAdaptersInfo

user32

GetCursorInfo

crtdll

exit

framedyn

?Compare@CHString@@QBEHPBG@Z

Sections

.MPRESS1
Size: 105KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE