NEAS[.]b033d9e8a5f01a2996127b2126973490[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.b033d9e8a5f01a2996127b2126973490.exe
Size

66KB
MD5

b033d9e8a5f01a2996127b2126973490
SHA1

d689ad476fd7ed6257a04f00462b683f60542d17
SHA256

50d8b529cdd348931df6dccddaacc305617450a6c8fb48766e525f3576f64dce
SHA512

06cd1a2fd22726e97404165c74ee7c975734ac1a34c1a6fd5618b199fba03b131a38c9072da87e59b5dda1f8feb14b9973afc9bc7c1895e026fa09bf9514e34c
SSDEEP

1536:7YsRaSUtuTCK16ca+8cQQ7FSetCNOFMNADi8aADr71G1qXB:MsT6cQ7iCYIO1f6s

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.b033d9e8a5f01a2996127b2126973490.exe

Files

NEAS.b033d9e8a5f01a2996127b2126973490.exe
.exe windows:4 windows x86

7d53ad84559a8ec086f8457382630608

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

PssWalkMarkerCreate
DisassociateCurrentThreadFromCallback
K32QueryWorkingSetEx
K32InitializeProcessForWsWatch
FindResourceW
FindCloseChangeNotification
ReplaceFileW
FindNLSString
SetFileInformationByHandle

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE