NEAS[.]5c47c19595e54b31fa79029c39501430[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.5c47c19595e54b31fa79029c39501430.exe
Size

66KB
MD5

5c47c19595e54b31fa79029c39501430
SHA1

06f0aa695f4b0b74e7f6c75085f68257607017a1
SHA256

e3693f918391e967cb622f15eda732305efa54daac99cad3563294443dedfd1f
SHA512

a4b8853d18e4682e4df61727bf1345d2a56d820e29730a4f69eaff9f116f9fb51354177a3dc37fb9a71abe16ce1ed63227969c17d3547cdf88a616883388c702
SSDEEP

1536:eEr9zOD5wGgv46Acv32A7EeYt+KeF1a8VAHA8:eg9yl9gv46AU7zYt+K0a8uHr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.5c47c19595e54b31fa79029c39501430.exe

Files

NEAS.5c47c19595e54b31fa79029c39501430.exe
.exe windows:4 windows x86

c5e9db1bc8ba92aa6ad1d74902c583ce

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WritePrivateProfileStructA
_lread
SleepConditionVariableSRW
SetXStateFeaturesMask
GetExpandedNameW
QueryActCtxSettingsW
CreateJobObjectW
SubmitThreadpoolWork
FindFirstVolumeW
CreateThreadpoolIo

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE