NEAS[.]a218584c8be05755d43f55e690f2d610[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.a218584c8be05755d43f55e690f2d610.exe
Size

3.2MB
MD5

a218584c8be05755d43f55e690f2d610
SHA1

8043be4fe3b441176f6c4bda9d63a0058c1a2047
SHA256

d282a8960b29dbb150d559d02fd70fe273a3d561a8be8d2b4804fc592fd62ec7
SHA512

c44fdc1d6145e9f39df928936c0f446239ef13cca5e97e550bfdf007bbf4b260df30a033401e515ec753bf68a237db2fe98f405c8572921ce056f46c1aa5f973
SSDEEP

49152:xJg6XLR0XiXF4s6L8RrFyl6/YoV++yZ2iheIA4k3nhQl0Ke3H1yN/SUQOV+Dvn+:xy2LRIrMfQoV+Mi8x4k3nmeIgDOsvn+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.a218584c8be05755d43f55e690f2d610.exe

Files

NEAS.a218584c8be05755d43f55e690f2d610.exe
.dll windows:5 windows x86

7ee5d66d33033521bd0d3c62255e3bc7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

ChrCmpIA

advapi32

SaferComputeTokenFromLevel

oleaut32

GetErrorInfo
SysAllocStringLen

gdi32

CreateEllipticRgn

kernel32

GetUserDefaultLCID
OutputDebugStringA
LoadLibraryA
GetModuleFileNameA
GetProcessHeap
GetSystemTimeAsFileTime
GetLastError

lz32

LZOpenFileW
GetExpandedNameW

setupapi

SetupDiDestroyDeviceInfoList

Sections

.text
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 200KB - Virtual size: 197KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ