NEAS[.]a56e0ed46147f15196d9a668c1f58650[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.a56e0ed46147f15196d9a668c1f58650.exe
Size

66KB
MD5

a56e0ed46147f15196d9a668c1f58650
SHA1

2a84c0667912ab659e820a71faa28499c586cfcb
SHA256

cfea70826c97f67b92e2745be9205299bece73f102cf9581dbdbc9fd9ab58b97
SHA512

2696e55aac5680b01925c386b163ff2280aaeacd876b922f2f2317aeac41266b7f43f38f63f3a99bd05b90cfd8e0f7af73ff7d97f5edcab64cbfa5dcdc3a48c4
SSDEEP

1536:chdbpLvXurL2u68jlv3dkbvtKiu2+bFujZOB4CggoqjATBScLWtj+0Ieyr+:K5UiP+vKbciu25jZOOzC1c6t1M+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.a56e0ed46147f15196d9a668c1f58650.exe

Files

NEAS.a56e0ed46147f15196d9a668c1f58650.exe
.exe windows:4 windows x86

4e5a427227c41849166617257d8b2dfd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MoveFileWithProgressA
QuirkIsEnabled2Worker
CreateSymbolicLinkA
EnumerateLocalComputerNamesW
SetSearchPathMode
GetPackageFamilyName
GetWindowsDirectoryA
CreateMutexW
CreateSemaphoreExA
DnsHostnameToComputerNameA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE