NEAS[.]bf893707505ba989b6616fbc05343760[.]exe | Triage

Sharing

General

Target

NEAS.bf893707505ba989b6616fbc05343760.exe
Size

66KB
MD5

bf893707505ba989b6616fbc05343760
SHA1

9a5c99654686170f5d2bd0a7ddc06219eaac44bd
SHA256

61b44f60b62fd8ef1ab86bf7be9c1ecdcf5230b41e2f5f6b419ab1317ab8642d
SHA512

e94bcabd9d6432be0c3de82053b9292f114500bd1d7c1a782ef1a7950af11d154e86224b96b7036330c05248a83ee3627d65b4cd030fd2febe10dc296ce9eadb
SSDEEP

1536:3UHYo5arwfSJpgGRhS/tveE2pPDRKonsMRa5/UE2UIdgJbm:3UHY7fgGKwDRKQ8aiJbm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.bf893707505ba989b6616fbc05343760.exe

Files

NEAS.bf893707505ba989b6616fbc05343760.exe
.exe windows:4 windows x86

5f5b3e4b73dc5517d2589e10b3598d7d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetPrivateProfileSectionNamesA
RegDeleteTreeA
GetDiskFreeSpaceW
GetBinaryType
Wow64SuspendThread
TermsrvDeleteValue
ParseApplicationUserModelId
LocateXStateFeature
InitializeProcThreadAttributeList

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE