NEAS[.]c1a486af5a9fb6c747d62c8e308b1c80[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.c1a486af5a9fb6c747d62c8e308b1c80.exe
Size

66KB
MD5

c1a486af5a9fb6c747d62c8e308b1c80
SHA1

94494921cd739f834c3990a2792043611fc46a85
SHA256

1b26095540783b87a2249c1bc21c0b6399064c2e6bc6a83ff028dae4f653bf97
SHA512

49c574997c1388994c079f83c7de6fa538cfa3dbf3d6b5d6c79bf41b4b5be24ef5f984f9f8293afa61f9b3d1a3c8198c94da0565effafab4bd03e5bd4dfcd030
SSDEEP

1536:OTXkdazy7EKVN21vWmup46d3eyTEVCqbEprN:+XwazeEYN2JWmMjEyThUEprN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.c1a486af5a9fb6c747d62c8e308b1c80.exe

Files

NEAS.c1a486af5a9fb6c747d62c8e308b1c80.exe
.exe windows:4 windows x86

0da9c01b7b0a1fddeec902d54bf240da

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TlsSetValue
K32EnumProcesses
GetProcessInformation
GetFileAttributesExW
GetProfileIntA
ReleaseActCtxWorker
AddSIDToBoundaryDescriptor
InitAtomTable
GetStringTypeExA
CreateSymbolicLinkTransactedA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE