NEAS[.]3fa196746d23424a4c4518450aa72200[.]exe | Triage

Sharing

General

Target

NEAS.3fa196746d23424a4c4518450aa72200.exe
Size

66KB
MD5

3fa196746d23424a4c4518450aa72200
SHA1

b805df593e3611f8e65a15e1128e9662e092c01b
SHA256

9cb6222ea50fd34ba30123b2bc74b7f82e2854183b00ce5283bd691e7ea98685
SHA512

ecf622ecd435ecd8d3f5939b98f49dc94a8810574f5ed6d944f3aab5946fda5b2e7569a9707fb44144ec31025b6e7e2fef5bd4789232bcdb091b971273f0bf88
SSDEEP

1536:pxLbE74biBXldnJjRJInVMHQozTxPDYYupUvBRl20IyCzvdJ1I99V:HbEEbiLJJjRe1SlupUB20dCdJ1IHV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.3fa196746d23424a4c4518450aa72200.exe

Files

NEAS.3fa196746d23424a4c4518450aa72200.exe
.exe windows:4 windows x86

c3e194cd7980feef0584f9ca5e6b2e62

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TermsrvCreateRegEntry
SetThreadpoolTimer
ActivateActCtxWorker
GetDateFormatW
ReplaceFileA
AddSecureMemoryCacheCallback
WritePrivateProfileSectionW
GetFileAttributesTransactedA
CmdBatNotification
MapViewOfFileFromApp

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE