NEAS[.]a50dc9fffeeedb656922fc6999616370[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.a50dc9fffeeedb656922fc6999616370.exe
Size

66KB
MD5

a50dc9fffeeedb656922fc6999616370
SHA1

cbcebf9118066290fff28e59193a0be327076edc
SHA256

90918a66beba400bf97c690f178eecd525d6d6f09c48825e0c82160bdf7460bd
SHA512

bed876c44e06f5ea3e81b282e2a5bc97de83b6648eb4b9c9e2375e3b4d8ef9c4455143e02f58de77ab9a51c29af1eeeabf47facdebbaf658b15676d5a27e6eb7
SSDEEP

1536:fnpF2DSL5jp5HmXtOWC3B1EfJg94sdvS3CC:fnxL5jpJ0UMhg2so3CC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.a50dc9fffeeedb656922fc6999616370.exe

Files

NEAS.a50dc9fffeeedb656922fc6999616370.exe
.exe windows:4 windows x86

74cd30ae638d03a0dedee24ab054277d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetConsoleCommandHistoryLengthW
VirtualAlloc
AddRefActCtxWorker
timeGetSystemTime
ReadConsoleInputA
GetUserDefaultLangID
BackupRead
StartThreadpoolIo
GetProcessIdOfThread
FindFirstVolumeMountPointW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE