NEAS[.]b6d4024cc76fd7e67037d31269ebcf10[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.b6d4024cc76fd7e67037d31269ebcf10.exe
Size

66KB
MD5

b6d4024cc76fd7e67037d31269ebcf10
SHA1

c2ea8ecf8d9954629b924a9e691d4741dafc797f
SHA256

de90bb65edb987498d7339003c109f34b3d355cc5434f1224587b9c54b0a39cc
SHA512

ed5b03b582815bdc0590f77363ac8c524a6db72585be017361591646fecc4d11264dd7d23d543686464943885b9ab83ec2c78a02c546d1d6bc43f6635b64d71f
SSDEEP

1536:ixcGH58QBa2a+4nJBN8rr32FYEc0b011xSKY9wF34UI:iGG39+Jv8rDM+1b09w141

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.b6d4024cc76fd7e67037d31269ebcf10.exe

Files

NEAS.b6d4024cc76fd7e67037d31269ebcf10.exe
.exe windows:4 windows x86

3fa3728800f1893d78b5bb58604b12d4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetNamedPipeServerProcessId
LocalAlloc
EnumTimeFormatsW
QueryThreadProfiling
GetGeoInfoEx
DeleteFileA
DnsHostnameToComputerNameExW
WriteProfileStringA
BaseFreeAppCompatDataForProcessWorker
GetTimeFormatAWorker

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE