NEAS[.]26ddcf157d6f9e5402cb8052cf72abb0[.]exe | Triage

Sharing

General

Target

NEAS.26ddcf157d6f9e5402cb8052cf72abb0.exe
Size

66KB
MD5

26ddcf157d6f9e5402cb8052cf72abb0
SHA1

81c268439af1faf04a9e7f0bf9df5359ae9056eb
SHA256

2647803227907597fc5c71291c62bcaee85b8543e96d2fac79f75aa0f71a9763
SHA512

4ccacc5b54dd70687300b3b9eae039f3e6cbd013bdab9fd183748a99d5b270d936010edac14e3a34e5c4d51c2aa09c9ff83659487531dd2f2d47f26b20b6a63b
SSDEEP

1536:Sl9tH8EQ2356kTcq2ECirwgYRuPwNad1QcKYOD5:M998EQF4OirauKaY4Ot

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.26ddcf157d6f9e5402cb8052cf72abb0.exe

Files

NEAS.26ddcf157d6f9e5402cb8052cf72abb0.exe
.exe windows:4 windows x86

ad4111fee76aa455d4f0eb34a04b7945

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenFileMappingW
DeactivateActCtxWorker
QueryProtectedPolicy
QueryMemoryResourceNotification
WriteConsoleOutputAttribute
FindClose
GetLogicalProcessorInformationEx
EnumDateFormatsW
GetPrivateProfileIntW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE