NEAS[.]ca5138936abf49a6d6cdbdc5e9328db0[.]exe | Triage

Sharing

General

Target

NEAS.ca5138936abf49a6d6cdbdc5e9328db0.exe
Size

66KB
MD5

ca5138936abf49a6d6cdbdc5e9328db0
SHA1

7673fee77c68c04d69d19bf5b66532156a5ea1c9
SHA256

760bb42c43b95f524cf30615a075fe53d9781b883f4bd3f18e5157a2e08dfb91
SHA512

e12b2c9f8537db6b40b52591a6e144c77fa16ec55c224a516e44057f1b2f5d9134c5759123025c9dc2d9242b6d57b3748a8658894677db677d9711421004a1a7
SSDEEP

1536:i1ol26fssK5HldQa/ZVAvgGmyEBTMDvhMf0MSobUpAqF0:c6i6R45FBTMDvQ0WbUBa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.ca5138936abf49a6d6cdbdc5e9328db0.exe

Files

NEAS.ca5138936abf49a6d6cdbdc5e9328db0.exe
.exe windows:4 windows x86

b9582ea217cab97507eea0fb23410b0a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
GetPrivateProfileIntW
GetVersion
RaiseException
SetFileIoOverlappedRange
CancelIo
LZSeek
TerminateJobObject
HeapReAlloc
CloseProfileUserMapping
GetUserDefaultLangID
WerRegisterMemoryBlock

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE