4a3f63ec564eef3501a2eb4c4b755550_NEAS | Triage

Sharing

General

Target

4a3f63ec564eef3501a2eb4c4b755550_NEAS
Size

138KB
MD5

4a3f63ec564eef3501a2eb4c4b755550
SHA1

84eea6d339fbb13e82a817950943c022b3587071
SHA256

0eefb98723cda707326d889e28d5fb9dbb2c12cdbb5acd7ce43b1e123e764800
SHA512

f218e5e4ab24d004a46acf2d2ecdd5d555a96dae4d41ab3d2c1fae51a20e8214dbf0930ec1633cb60adca47b12ac9d4ef44bb42dab68fa390ec44fe57b1f7a1b
SSDEEP

3072:9hlDUC7wGnLduIVH1v/+U40Bbm7HWKlrreiBDcP/d:9DDIGn8IVV3+UjBSbWKl1DcN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4a3f63ec564eef3501a2eb4c4b755550_NEAS

Files

4a3f63ec564eef3501a2eb4c4b755550_NEAS
.exe windows:1 windows x86 arch:x86

214a4fdc45b1e49eaeb17c7ca1b86e49

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
GetModuleHandleA
GetProcAddress
GetTempPathA
LoadLibraryA
RtlUnwind
CreateFileA
CreateFileMappingA
VirtualProtect
lstrcpyA
CloseHandle
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoA
lstrlenA
GetVersionExA
GetSystemDirectoryA
CreateEventA
OpenProcess

crtdll

__GetMainArgs
exit
raise
signal

psapi

EnumProcesses

advapi32

RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegCloseKey
OpenProcessToken
FreeSid
AllocateAndInitializeSid

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 125KB - Virtual size: 364KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 384B - Virtual size: 384B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ