68177813b59512f8e9f8b00e045638e0_NEAS | Triage

Sharing

Copy URL Twitter E-mail

General

Target

68177813b59512f8e9f8b00e045638e0_NEAS
Size

760KB
MD5

68177813b59512f8e9f8b00e045638e0
SHA1

9440ff0ae6131e7fab9d8332a39a31666ca555d2
SHA256

ca4d6928281fe717147da00b43baea8c410103605eb6670e1a9b6aa89f8621aa
SHA512

2a218c8036c7d15a74661fefa3713c7d3a90367212cbe9e2b8741075368210f1e8df003e48a20a2b1cc4315145e00e8f22787e99021b1c550a8956778d7d9f2c
SSDEEP

12288:SWXYGm0JN4zLRiRB3dG8EblnFoGno1/twNQfNIg1h0WnmFZTrGCcFgHLooQaOiYX:SWXBmq4z4BNOblAqNeIu/WZRLoILYlOV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
68177813b59512f8e9f8b00e045638e0_NEAS

Files

68177813b59512f8e9f8b00e045638e0_NEAS
.dll windows:4 windows x86 arch:x86

36b06a6be70ee2f20f4dcd85b7620810

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\devout\sparbuch\sparb09\win32\wfrm209.pdb

Imports

kernel32

TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime

msvcr80

_amsg_exit
_adjust_fdiv
_initterm_e
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
_crt_debugger_hook
__CppXcptFilter

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 876B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 740KB - Virtual size: 737KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ