NEAS[.]2f9439eb4048ed45db400b78d044c1f0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.2f9439eb4048ed45db400b78d044c1f0.exe
Size

268KB
MD5

2f9439eb4048ed45db400b78d044c1f0
SHA1

3e968e9d1bec4a3a5de375f4d95cff0803bc99eb
SHA256

115b31138303edf548557241a86228e3dde2250236531ea9e9700dd11396cbf0
SHA512

70152ba146c4b0a4179120cc608cf948dc7be3ea7d7c31584b22be0fa148a55d2da728337ffc6b15c5b0c36667ae5d6f79b1b07b9b73107efc8063b04ecd2d87
SSDEEP

6144:bntyTnIo135XX+QOpFcDdYiso5iSM3Omlc67NyYeV:KnD1343pWgoYSNtqNq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.2f9439eb4048ed45db400b78d044c1f0.exe

Files

NEAS.2f9439eb4048ed45db400b78d044c1f0.exe
.exe windows:4 windows x86

d994c8c1d13c3659d4690e991014d281

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetThreadPriorityBoost
WriteConsoleOutputA
ReadFile
WTSGetActiveConsoleSessionId
QueryDosDeviceW
Process32FirstW
CancelDeviceWakeupRequest
SetConsoleCursorInfo
GetProfileStringW
ZombifyActCtx

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 57KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 72KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 54KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 70KB - Virtual size: 91KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE