NEAS[.]7872157c8141e426cde4c5066fe96d40[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.7872157c8141e426cde4c5066fe96d40.exe
Size

145KB
MD5

7872157c8141e426cde4c5066fe96d40
SHA1

ff8b5c7e047d66c5d81876c06239a420cdbbab71
SHA256

e61ce4658b03c29774572719a7548acf2d45effc8c67292a5088119736189799
SHA512

e036f48a2146d061b4d025d57c0db6db631b4869509c8411c42016bd97f774f23212b39646c1d0ba6e0b1a564f76f1a25b5a729640a056580d7c3cea593714ba
SSDEEP

3072:ywoo1becnWzsDLidFY6/otFJEd/jCxRZaLWHLrMOrFIunsJFl3Jf:yjo0m/LO+6SFmdbCxR0CHLrrrFIunY3F

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.7872157c8141e426cde4c5066fe96d40.exe

Files

NEAS.7872157c8141e426cde4c5066fe96d40.exe
.exe windows:1 windows x86 arch:x86

041d8efbdc4cdaae253f4a3c7918b192

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

iphlpapi

GetAdaptersInfo

kernel32

GetModuleHandleA
GetProcAddress
CloseHandle
GetTickCount
RtlUnwind
WriteFile
GetLastError
CreateFileA
GetStdHandle
GetModuleFileNameA
MultiByteToWideChar
GetFileType
HeapFree
LoadLibraryA
GetLocaleInfoA
FreeLibrary
GetProcessHeap
HeapAlloc
FormatMessageA
SystemTimeToFileTime
lstrcmpiA

crtdll

__GetMainArgs
exit
raise
signal

pdh

PdhCloseLog
PdhAddCounterW

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetSidLengthRequired
RegSetValueExA
RegCreateKeyExA

user32

LoadStringA

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 340B - Virtual size: 340B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ