NEAS[.]d05753270fd110222f3e9f1ff837e970[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.d05753270fd110222f3e9f1ff837e970.exe
Size

3.2MB
MD5

d05753270fd110222f3e9f1ff837e970
SHA1

cf8840d43484e8b520b241d93460ae90bcd078a4
SHA256

4d72e1fd3f264160fde21fdf17621d9b9690ad1eea13471092291ace3e85b917
SHA512

88473bc324c139a143c2015f0239fddd2423b71c16e3761268ac09fd36354c5551bd79c8ba4cc8a2ccbc9bf3f1921346cc3cb25b3b197c06dbfe5d4bd88d8b7e
SSDEEP

49152:9nA0F/3elkda1myNLErzC+jI9wxHySIl8kY2y10p64hrEu:e05OlqSEr+7S1p2JY23VhrE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.d05753270fd110222f3e9f1ff837e970.exe

Files

NEAS.d05753270fd110222f3e9f1ff837e970.exe
.dll windows:5 windows x86

a00820c05a45f7822203ed781bebd9c9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryExA
OutputDebugStringA
GetSystemTimeAsFileTime
GetUserDefaultLCID
GetProcessHeap
GetModuleFileNameA

setupapi

SetupDiDestroyDeviceInfoList

lz32

LZOpenFileW
LZClose

gdi32

SetDIBits
SelectClipRgn
FillPath

advapi32

CryptImportKey

oleaut32

GetErrorInfo
SysAllocStringLen

Sections

.text
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 196KB - Virtual size: 195KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ