NEAS[.]48589cb0f52718c09758c84bd13b9450[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.48589cb0f52718c09758c84bd13b9450.exe
Size

1.6MB
MD5

48589cb0f52718c09758c84bd13b9450
SHA1

ef11a85fd1406b292fec73050e403208be412ce6
SHA256

3fae7845a8f7d8ae6b71c26086d6a8be391ef4b350d0af1f6fdad7aba31ff695
SHA512

9acb005a8ba8c7b855ab02e06e1ae08f7414c42880bf8ce38c8d57110b75ef9a2b66847a6f751b596c184f0e3a53dacfbeee727c972b2b0e5b1b69d06b53ce12
SSDEEP

24576:UyrUC5mzAUFyyaZw94Ds84n1hVJZZI9ChN5u9VLxSBMJ/HqldbECzZTXwzaV3I+:NXmO/Zw9TjA9Tr4uJCE0Aza1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.48589cb0f52718c09758c84bd13b9450.exe

Files

NEAS.48589cb0f52718c09758c84bd13b9450.exe
.exe windows:5 windows x86

99717b21f18574bede896864dc50509f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32 kernel32

TerminateProcess �

kernel32

ExitProcess

msvcrt

malloc

iphlpapi

GetAdaptersInfo

psapi

GetMappedFileNameW

user32

IsWindow

advapi32

RegOpenKeyExA

Sections

.text
Size: 22KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ