NEAS[.]36aea641bf4741222c5b87a9dc074790[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.36aea641bf4741222c5b87a9dc074790.exe
Size

9KB
MD5

36aea641bf4741222c5b87a9dc074790
SHA1

38f67196198b9607367884cad840ac8fee8d57ba
SHA256

9d3f855e6cdbc8b02c0e784badc408ca9231bde29a027d29c2f068028aeeda36
SHA512

a28fa67ea6ae40a9c43e620a0687c6623dbd4ff221f47b08e94a44b87d5c5b4e4a0d9acaab8ef6cb3109fd06e95470f210b6a9e31c9efa455b4ce40e2327c9c5
SSDEEP

192:CilmVnIhA/kHQu+mi6pjPOCLljqc1YbccBCmP4oynSl62p:CilmVIhykLvjGCLscmccBf4gz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.36aea641bf4741222c5b87a9dc074790.exe

Files

NEAS.36aea641bf4741222c5b87a9dc074790.exe
.exe windows:4 windows x86 arch:x86

6d7cd886ccaad4b015183e445d9f0a72

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
Sleep
FreeLibrary
DeleteFileA
GetTickCount
ExitProcess
FindFirstFileA
SetErrorMode
CloseHandle
SetFilePointer

user32

MessageBoxA
wsprintfA

mfc42

ord800
ord4202
ord2764
ord561
ord815
ord2915
ord537

msvcrt

_itoa
fclose
fscanf
fopen
strchr
rename
__dllonexit
_onexit
_exit
_XcptFilter
exit
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__CxxFrameHandler
sprintf
_strnset

msvcp60

??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ