NEAS[.]660ec9d3881a4f1a74720c683248e670[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.660ec9d3881a4f1a74720c683248e670.exe
Size

558KB
MD5

660ec9d3881a4f1a74720c683248e670
SHA1

84c7ce94efa879bf57658da1052bfde5cc863f23
SHA256

1e71bbf73add6129f0b37799aceb24c6a31168d0ae408699f0e58e2a9c5560c5
SHA512

4f9c7487db0110bcc84639212be9d3aec59fbf69be2161f209525e3a8e43e1a7c139d128672b5c72ec1c5c8e39dbfa77a6df0af3c91e9d9e656e70d058b8eb06
SSDEEP

12288:LYKimL85vbUVgtfp2MhJQcmFSqIgYVrbuDdS3:Lfo5DUA5hJLJVPadS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.660ec9d3881a4f1a74720c683248e670.exe

Files

NEAS.660ec9d3881a4f1a74720c683248e670.exe
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

GetIPWDaemon
GetIPWPort

Sections

CODE
Size: 340KB - Virtual size: 339KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 97B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 178KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ