NEAS[.]d80dbb42151e493eefa0c7694b4636e0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.d80dbb42151e493eefa0c7694b4636e0.exe
Size

320KB
MD5

d80dbb42151e493eefa0c7694b4636e0
SHA1

3aada02dc36def9b7f13c791d47d0b4a015f23e6
SHA256

1ab1d5ac0c3b0dd392347390dca403ffd74b9654ce3ee5c2e9aad93e2c670d02
SHA512

17b241f3531af69242dbddd5fb997205e20b61d1bab1344e14fd94630749b8da145e38a06106e0c54302fd3827e6042430c41b587bcad9498f95fb47143c7d90
SSDEEP

6144:zgu1EBH2RfS155ONNXBuWoJBO9OMbHLkAqF7Ief9UmM7/uT:zguCJ2EB0NxDIBuOFe7/uT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.d80dbb42151e493eefa0c7694b4636e0.exe

Files

NEAS.d80dbb42151e493eefa0c7694b4636e0.exe
.exe windows:4 windows x86

e87542f01cc9d53646e241f4e0073b65

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
InitializeSListHead
GetModuleFileNameA
SetThreadPriorityBoost
SetVolumeMountPointA
EnumCalendarInfoExW
NlsConvertIntegerToString
GetNumberFormatA
CreateFileMappingA
EnumerateLocalComputerNamesA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.brdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tc
Size: 244KB - Virtual size: 244KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE