NEAS[.]ad89c560e944d57711fb6e46d63cab20[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.ad89c560e944d57711fb6e46d63cab20.exe
Size

59KB
MD5

ad89c560e944d57711fb6e46d63cab20
SHA1

c7154273817a4776de8e3a1c36e589bd19ab9673
SHA256

e883f10dec0496037ce76f0d7c3b8c232db4f2446999873eadc72b587a86417c
SHA512

0bb8c330aaf9cb14be329edecdfad674085949ae3b4689124c2e93f0f2dd90edd6f3622b881c87c39064a97b8978fa91d29499d0f8407aea21c35d68a834781f
SSDEEP

1536:k5XYf2KN535MjG6e6jeptFln6cdNT7FtBEZO4GZ83h:f+Kj35Mj66jOlVD/r4OKh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.ad89c560e944d57711fb6e46d63cab20.exe

Files

NEAS.ad89c560e944d57711fb6e46d63cab20.exe
.exe windows:4 windows x86

5e5b587ea5556e78c6fe2f3536594f65

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetupComm
SetFirmwareEnvironmentVariableExA
FindFirstChangeNotificationA
SetLocalPrimaryComputerNameA
Module32First
CreateFile2
EncodePointer
GetNamedPipeServerSessionId
DeleteProcThreadAttributeList

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 36KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE