NEAS[.]df55f4cd97ee49085f1e70c841958f40[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.df55f4cd97ee49085f1e70c841958f40.exe
Size

66KB
MD5

df55f4cd97ee49085f1e70c841958f40
SHA1

b3089642b48cbcb1db26999006c1c838e741639a
SHA256

71ff7790e614edffd2519d8ebaf6c8c1f4b5b904e9a6cf9f6f842edea1b3422c
SHA512

540906ef54ba299a1f3f36c1afb0e9a16c0b1cc78f9506cd51208ea0ebff28301168a643b2e9df42734e4ec599c5216bd684f0851bddd6e5a7195cf724d1ae6a
SSDEEP

1536:EUKo0+e9+dvZ4XUGy1MXKmvu1YA4TnzUmLQ:OHwvnGhXXvgqnps

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.df55f4cd97ee49085f1e70c841958f40.exe

Files

NEAS.df55f4cd97ee49085f1e70c841958f40.exe
.exe windows:4 windows x86

8c6095e6e69e5e1f3e301b1c89966194

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVolumeInformationW
lstrcmpiW
SetTapePosition
SizeofResource
WriteConsoleOutputW
RtlCaptureStackBackTrace
CreateFileMappingFromApp
K32EmptyWorkingSet
lstrcpynW
GlobalAddAtomExW
SetLocalPrimaryComputerNameA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE