NEAS[.]c54244dbb869202b8bec2e78b0430900[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.c54244dbb869202b8bec2e78b0430900.exe
Size

320KB
MD5

c54244dbb869202b8bec2e78b0430900
SHA1

27b42a681a63e6a0dc66894846ce33ac33271fbd
SHA256

23c926f560d03e72cd6ecff6159f89d9b331f64b838f4f4f9d78dbfc7d8d1869
SHA512

5bae25a94224484a4b7feb4a79f546fb2692ec17f7e80ab6c7cfd32932bad4b8166c643127ddddd04c685ab48b7684e24699a84fc55c6eb969c3301e1250aff8
SSDEEP

6144:RQnS8ay4H2RfS155ONNXBuWoJBO9OMbHLkAqF7Ief9UmM7/uT:Onkp2EB0NxDIBuOFe7/uT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.c54244dbb869202b8bec2e78b0430900.exe

Files

NEAS.c54244dbb869202b8bec2e78b0430900.exe
.exe windows:4 windows x86

250dcb0d91fcac39617019595ee20ab7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ProcessIdToSessionId
GlobalMemoryStatusEx
CreateJobObjectW
QueryDosDeviceW
FlushInstructionCache
Thread32Next
GetModuleHandleA
LZCloseFile
LZOpenFileA
QueryDosDeviceW
GlobalFindAtomW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.brdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tc
Size: 244KB - Virtual size: 244KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE