NEAS[.]b8b51bfd85140bdee65add6f0a1f9470[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.b8b51bfd85140bdee65add6f0a1f9470.exe
Size

66KB
MD5

b8b51bfd85140bdee65add6f0a1f9470
SHA1

01ee78841ff00e22116f74c4ddc9ac002fda48e6
SHA256

609af3c44751df3a5709f27541ddabd7cd38a4496894e3386d1fcf460c565fad
SHA512

7bf10240b2aedda047cdb2203bbb1b29b06f4e4edbb72d071032222678567e9c11a0d1fb8513ee9376d64a5d709eb5dbebffb7c08e2afd4cd9131d0aa3daeb03
SSDEEP

1536:nBVzT7bk6tJ9gSKibJHvVVZ/25SAdpqlExpIhCTRl3cj1V:g6tgu1HvvZ/2siqaxpIATRZcjn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.b8b51bfd85140bdee65add6f0a1f9470.exe

Files

NEAS.b8b51bfd85140bdee65add6f0a1f9470.exe
.exe windows:4 windows x86

971be9196799e6b8587fe438394dbf61

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LZCreateFileW
LocateXStateFeature
SetFileInformationByHandle
DebugActiveProcess
PssWalkMarkerSeekToBeginning
InitOnceExecuteOnce
SetErrorMode
BasepQueryAppCompat
DosPathToSessionPathW
CreateSymbolicLinkA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE