NEAS[.]f17f17f7357d4e51cecd952b23944260[.]exe | Triage

Sharing

General

Target

NEAS.f17f17f7357d4e51cecd952b23944260.exe
Size

66KB
MD5

f17f17f7357d4e51cecd952b23944260
SHA1

eee603845c98b100e2f4854000114d2dd1356946
SHA256

4b88060305a6f212b2ec137bb4cdb3ef06e0c4846af9a0869a4d9b6c00bac60a
SHA512

cc31918ec6b03bf4c1dcd582d5b426512aae0b724296d5ba6ff01654402d8ff2d4a5c7b3a819b6540182ddde4ceb43f80f99f4fdd61158d1dad4a55477badc37
SSDEEP

1536:oNk9mFGh+MOqA/WVD4Xw/bfw8NA1skK3wfjsGQvb7rqwZV:56B/MH7zNas6fjTIPrqwZV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.f17f17f7357d4e51cecd952b23944260.exe

Files

NEAS.f17f17f7357d4e51cecd952b23944260.exe
.exe windows:4 windows x86

17264fcc5dae1ba1759451f329e21595

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteTimerQueueEx
DeleteFileW
ActivateActCtx
ReadDirectoryChangesExW
K32GetProcessMemoryInfo
GetTempPathW
InterlockedExchange
WaitCommEvent
CreateHardLinkW
MoveFileW
CreateFileMappingNumaA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE