ed88752152d278cc08d19baa6dd74230_NEAS | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ed88752152d278cc08d19baa6dd74230_NEAS
Size

992KB
MD5

ed88752152d278cc08d19baa6dd74230
SHA1

32a2df5b3a69865c24fb7642dcbba38456582e99
SHA256

0a9d831bc0d22231c53746eb4d6e8f42fd9d6adace88f894907ad38b698fb31c
SHA512

461bf6a7993c0fafc9d5892efacbddef58f748bae5c5dbd93b08b0524a20e55ebeaf520762f19e29526a038e278be9126e72557a3d3ef6db6e9c676a80a02847
SSDEEP

12288:Wh3ZukLF5kU0o3mOxXJXlZCRX9hnJKLqOHB7rFQjtb0KzeKtwOKKzD:WhMkxBWQXJ+9hQTxhQpb0KSKOwD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ed88752152d278cc08d19baa6dd74230_NEAS

Files

ed88752152d278cc08d19baa6dd74230_NEAS
.exe windows:4 windows x86 arch:x86

8c8cd2fe8f466202b9cc82f6156dad3c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesExA
HeapDestroy
HeapFree
HeapCreate
HeapAlloc
GetProcessHeap
CloseHandle
Sleep
ReadFile
SetFilePointer
CreateFileA
QueryPerformanceCounter
ExitProcess
GetModuleFileNameA
GetProcAddress
LoadLibraryA
VirtualAlloc
VirtualFree
IsBadReadPtr
lstrcmpiA
FreeLibrary
GetStartupInfoA
GetModuleHandleA
HeapReAlloc
GetCommandLineA

user32

wvsprintfA

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 722B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ropf
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ