NEAS[.]6380a8724549d83217a2ccf18aaafcf0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.6380a8724549d83217a2ccf18aaafcf0.exe
Size

45KB
MD5

6380a8724549d83217a2ccf18aaafcf0
SHA1

2f23c085b9ac05bfbc8d46bb88477c5a025a040c
SHA256

fafb2b7231ca5b93082ef5c24a610659c068305cd22916b280af919bd7388000
SHA512

372c4455f9eafe2ef21a977ee0df248aae8e2c31489aa1cafb76cd0dc33c0329a6819cfc207acc91360eeaeebfb18e87536a6fbfad3126d640c12bc0e5ff45ad
SSDEEP

384:D3AhVC2PJ6wRC8vPpMiuMZkVo+TYNd8I6e68tcEHt66yKmeb+OK/i9Mbc:LCLP5uK6wL6UtVHt6/K3iji95

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.6380a8724549d83217a2ccf18aaafcf0.exe

Files

NEAS.6380a8724549d83217a2ccf18aaafcf0.exe
.exe windows:4 windows x86

1fb57b3425048683d2b780e925e7835f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

PostQuitMessage
SendMessageA
DestroyWindow
DefWindowProcA
PostMessageA
CreateWindowExA
ShowWindow
UpdateWindow
LoadCursorA
RegisterClassExA
LoadAcceleratorsA
GetMessageA
TranslateMessage
DispatchMessageA

kernel32

GetStartupInfoA
GetCommandLineA
HeapAlloc
HeapReAlloc
InterlockedExchange
ExitProcess
GetModuleHandleW
GetModuleHandleA
GetTickCount
HeapFree
RaiseException
RtlUnwind
lstrcpynA
LoadLibraryA
LCMapStringA
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
GetProcessHeap
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersionExW

comctl32

ord17

Sections

.text
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ