NEAS[.]f9ca089c2920f0475b84ad2cd976ca30[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.f9ca089c2920f0475b84ad2cd976ca30.exe
Size

151KB
MD5

f9ca089c2920f0475b84ad2cd976ca30
SHA1

31a0340efc62c199f08cc3de53b1bf8aafbc0e7a
SHA256

c3f5a6533dd8a1709cebc962a914077b3f193e826f69181a058413bef96509ee
SHA512

4c61dffb7160f81c5ad0a5d9a7192f0a02286cf4866a3b959012f96079afa780611e8654c0add30ec5c755b373a027de1ec36d71a910630f824b5b78f44cc6db
SSDEEP

3072:FQQb61UPyd94ZAzPX4nIlbZPUMUZC84dxeCGD8ROZ/Aqz1F/T:FDKzXboneRTHNGD0+Aqz7/T

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.f9ca089c2920f0475b84ad2cd976ca30.exe

Files

NEAS.f9ca089c2920f0475b84ad2cd976ca30.exe
.exe windows:4 windows x86 arch:x86

d21af85b4d8f71c33b346de557a81107

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CloseHandle
CreateFileW
FormatMessageW
FreeLibrary
GetFileType
GetLastError
GetLocaleInfoW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStdHandle
GetTickCount
HeapAlloc
HeapFree
LoadLibraryA
LoadLibraryW
LocalAlloc
LocalFree
MultiByteToWideChar
SystemTimeToFileTime
VirtualProtect
WriteFile
lstrcpyW
lstrcmpW

shell32

SHGetFolderPathW

user32

GetDC
LoadAcceleratorsA
LoadCursorA
LoadIconA
LoadStringW
RegisterClassW
IsClipboardFormatAvailable

pdh

PdhCloseLog
PdhAddCounterW

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW

ntdll

NtQueryInformationProcess

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 117KB - Virtual size: 364KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 632B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 518B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ