8eab74b138f97f16b7eba231b0942e10_NEAS | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8eab74b138f97f16b7eba231b0942e10_NEAS
Size

9.8MB
MD5

8eab74b138f97f16b7eba231b0942e10
SHA1

20f27f21650782c36b9a3b36a2178e8b883ffff5
SHA256

22cf8c5da53208eaf1e32cf26bc9711f0ff61a5e179345258b892d2bc562a206
SHA512

a87cea9e78bacf7fef67722f3260f8bdd04eb68394c51a496000530de40a7fab0058db29cf659727105f5332b36a12ff727ae6fc3689f705ed260ae7bd435e9e
SSDEEP

196608:iME36x7r+pN4hETAdkovS6GAWb0BL20uUaJK4PQdkBeuRvuoWMenc+xNc/Ir:CbQ2cd7S6lyXn4kVvuoWnnc+xmAr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8eab74b138f97f16b7eba231b0942e10_NEAS

Files

8eab74b138f97f16b7eba231b0942e10_NEAS
.exe windows:5 windows x86 arch:x86

9575f9c5728cc1feb9842e45a9d41497

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\MyGit\mylibrary\PeMemoryRun\Debug\PeMemoryRun5.pdb

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

SetDlgItemTextA

gdi32

CreateCompatibleDC

msimg32

AlphaBlend

winspool.drv

GetJobA

advapi32

RegCreateKeyExA

shell32

SHGetMalloc

comctl32

InitCommonControlsEx

shlwapi

PathFindFileNameA

uxtheme

GetThemeColor

ole32

OleUninitialize

oleaut32

SysStringLen

oledlg

ord9

winmm

PlaySoundA

gdiplus

GdipSetInterpolationMode

oleacc

AccessibleObjectFromWindow

imm32

ImmReleaseContext

Sections

.text
Size: 9.7MB - Virtual size: 15.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 37KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE