NEAS[.]d762ca88dbba275b3238a0477409a040[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.d762ca88dbba275b3238a0477409a040.exe
Size

66KB
MD5

d762ca88dbba275b3238a0477409a040
SHA1

e1b8572fa9a459896669735a54c8ff1941433efd
SHA256

82b94d2ecb47dd4c9f9669ec5dd97b0124a2e0995c5cf32564932ad5d01405bf
SHA512

641296f7b9eabadef95a660f90144a4f8201417c469beec3e58858b7b322ae16a782ea34f55fadcd662d2ab9d8df4563c67fbdd936235e7a2995f7b40c86944f
SSDEEP

1536:/NN4NUpycOtMsGarrgnOnxl5tENM7QV+GP3VqpJZapQIQ6:qd0a3gnOxxqV+QCUp7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.d762ca88dbba275b3238a0477409a040.exe

Files

NEAS.d762ca88dbba275b3238a0477409a040.exe
.exe windows:4 windows x86

15a466423d3498c71a2a5dc9c75ff20f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CopyFile2
NlsWriteEtwEvent
QueryDosDeviceW
Wow64GetThreadContext
OpenPackageInfoByFullName
LocalShrink
GetThreadDescription
BaseIsAppcompatInfrastructureDisabled
WerUnregisterCustomMetadata
TermsrvSyncUserIniFileExt

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE