NEAS[.]7ab225d218c16d864d5b9d8bac2c6420[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.7ab225d218c16d864d5b9d8bac2c6420.exe
Size

66KB
MD5

7ab225d218c16d864d5b9d8bac2c6420
SHA1

718d4b8aea2400bac5530f31e2a54696fec5c825
SHA256

fd303081505c408012c68c4b42c54d257f80ec5e02d7ba594b04968d0e6889c1
SHA512

54f4927d6175ff8acd1381ae52b325f03873517f915f343e9fca46473bb12a7e02573f49bb1afb282728711f9d2672d35a40578c6976e768f50c643945bef51b
SSDEEP

1536:8FyssqUthrzuUIo3xpRHYxrOx25ZnDb+EueyK09L:JssqUTryUIKRAzdb4lL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.7ab225d218c16d864d5b9d8bac2c6420.exe

Files

NEAS.7ab225d218c16d864d5b9d8bac2c6420.exe
.exe windows:4 windows x86

f562a960b15dc064808dd0d9f1828912

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateDirectoryExW
GetUserDefaultGeoName
CheckRemoteDebuggerPresent
CtrlRoutine
RtlMoveMemory
IsBadHugeReadPtr
GetExpandedNameW
RegOpenUserClassesRoot
GetProfileIntW
GetShortPathNameA
FlsSetValue

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE