NEAS[.]44704074f0f5d214043a746acb5e1900[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.44704074f0f5d214043a746acb5e1900.exe
Size

147KB
MD5

44704074f0f5d214043a746acb5e1900
SHA1

186b5537acb9a4db2221dd29f01ad8c1a00042de
SHA256

465b69116015cddf1b585bf3660b939bd53a9a65ad609f9083c6bafaceca6f86
SHA512

524c179bf35406361ca442dd2a63f48508d83ffc879c7b5084d6252408b868e7ba283bee997cb7c4e135a989f38a6f6cf6eb5b3415fbd61ff1b1300afd894bc7
SSDEEP

3072:yA4GU4QVmTIVPE7YaXYCfNicisIIMQgqoMNw21cuFQaArhGOU1nmi5GuMt:yF4OVPasyFQaAUn+uMt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.44704074f0f5d214043a746acb5e1900.exe

Files

NEAS.44704074f0f5d214043a746acb5e1900.exe
.exe windows:1 windows x86

4d82a1a8ac7dae247b7e65f9bf1173b2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CryptBinaryToStringA

kernel32

GetLastError
GetProcAddress
LoadLibraryA
RtlUnwind
VirtualProtect
GetModuleHandleA
FormatMessageA
LocalFree
GetTickCount
LocalAlloc
InterlockedCompareExchange

user32

GetCursorPos
CharToOemBuffA

crtdll

__GetMainArgs
exit
raise
signal

mswsock

s_perror

ws2_32

WSASocketW
WSAEventSelect

advapi32

RegOpenKeyExA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 40B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 126KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc2
Size: 427B - Virtual size: 427B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE