NEAS[.]b02897fe05576198a593dce3a5248100[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.b02897fe05576198a593dce3a5248100.exe
Size

66KB
MD5

b02897fe05576198a593dce3a5248100
SHA1

43e97582282d9fae7897b2fc26bb5b87a0788837
SHA256

4782480f2162347ade5b99c78b48ad0a5c22d160c66911eca6b430af3390b6be
SHA512

7f4039475061e7ccf6c49e257d0cd1ac2842d7b22fb3b79fbc21ffd7214da261ecf012abb5f7c3c0183e04a091063858034507d7e4eb0ff7345f3c22aed4ae33
SSDEEP

1536:MDxziLOzYopJ2z+6JDymisAivV1zrlJzG7eRpwxyO:aNiqzYopI+68mbAivVpPOeRpY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.b02897fe05576198a593dce3a5248100.exe

Files

NEAS.b02897fe05576198a593dce3a5248100.exe
.exe windows:4 windows x86

be1e7e6baf534f09c237c885622064fd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommTimeouts
FindFirstFileExW
SetFirmwareEnvironmentVariableExA
RegCopyTreeW
DeactivateActCtxWorker
InterlockedPushEntrySList
CreateTimerQueue
IsBadCodePtr
ResetWriteWatch
GetFileAttributesExA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE