NEAS[.]d5c93f59abb14f599a32805aa97a6480[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.d5c93f59abb14f599a32805aa97a6480.exe
Size

66KB
MD5

d5c93f59abb14f599a32805aa97a6480
SHA1

2a82b83c4faa7a209b6f3eecdeef30823715d5c5
SHA256

b09b37edd5590f2dad16c6c305ff32c14d02157db3ca875eb54fd6a10522644c
SHA512

3d79af29f94e2fc61c55621329aa1ee58a70c06d3ecebe1bcfe74d99b68d225829d2ca955a3de2a1de4e97ba08f7b6b1f8e633edc899059e9325fd488a2e4b1f
SSDEEP

1536:ugujnKCkMW73f50bQMJ1ek2DEienC+NVFQb82YyNfuWhKm1ufe5VkDwOWvcsgxXC:cyEGWVadKzLqqB/EDHme

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.d5c93f59abb14f599a32805aa97a6480.exe

Files

NEAS.d5c93f59abb14f599a32805aa97a6480.exe
.exe windows:4 windows x86

4c18e9c960af59fcc6337938210f46a4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenMutexW
QuirkIsEnabledWorker
GetPrivateProfileStructA
WriteProfileStringW
LoadAppInitDlls
RegisterWaitForSingleObject
TzSpecificLocalTimeToSystemTime
SetConsoleTitleW
IsBadHugeWritePtr
CreateSemaphoreA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE