NEAS[.]9aa1caaf1bbb4887c067fc1c7b71fb60[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.9aa1caaf1bbb4887c067fc1c7b71fb60.exe
Size

66KB
MD5

9aa1caaf1bbb4887c067fc1c7b71fb60
SHA1

eccc4be32abedf2cb73a64d4969f61cbe49d8b39
SHA256

e1e37047eb4d0bb292b712dcb2a9afc5c950dc12f7b990ceb634ba2e978ed761
SHA512

1a83fc3534da9c8eb230f1c3eefec0aeac94eda8c9afea9216937b0156edfdd6df9f9d1a9e1ed88bc6b05c093832941a560b3c7d1097d3700aa81380bf07da78
SSDEEP

1536:nSNwmcCevDX1HXqCnTpFLLeuU1k9h9b+hF9Ob/qy+Z2/vcn5VAwnNQC4:oZOj13qcT3/euU12kY/qG0AoNl4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.9aa1caaf1bbb4887c067fc1c7b71fb60.exe

Files

NEAS.9aa1caaf1bbb4887c067fc1c7b71fb60.exe
.exe windows:4 windows x86

0cfeb8d8f7093818717302c199c7d34c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenState
GetUserGeoID
Heap32Next
RegEnumKeyExW
GetCurrencyFormatEx
GetQueuedCompletionStatus
GlobalGetAtomNameW
ReadConsoleOutputAttribute
QuirkIsEnabledForPackage2Worker
CancelIo
DeleteFileTransactedA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE