NEAS[.]58318906637c36e3a1180bf4ab4243e0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.58318906637c36e3a1180bf4ab4243e0.exe
Size

66KB
MD5

58318906637c36e3a1180bf4ab4243e0
SHA1

3603914ac76c913bbe80ad6633657a0b72bb6462
SHA256

3ffca9a2493e03db14d4106dcbc67aafcaa661b9c8e357f05106bebf95ca3f7f
SHA512

548f7854d7b4a15ce68349cdab20f694d659a480dc4a0a25b0dc84cca5f259d273b1c666b57066c9f34802ba56b500a21d2196d97f2683ce0df8418664feb396
SSDEEP

1536:RcreXG9TQBhvFyxgJCN+9xptRaj8gEkiwiRtwj1xwbt27gy0ykXQ67euNBgTIQqO:pXG9TQBZFyxgJCN+9xptRaj8gEkiwiRo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.58318906637c36e3a1180bf4ab4243e0.exe

Files

NEAS.58318906637c36e3a1180bf4ab4243e0.exe
.exe windows:4 windows x86

a4eaa111f91c469b8451ab4b5655ecb0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetPrivateProfileStructA
GetSystemWow64DirectoryW
Wow64SetThreadContext
Toolhelp32ReadProcessMemory
GetUserDefaultLCID
WerRegisterRuntimeExceptionModuleWorker
PowerCreateRequest
DeleteFileA
GetLogicalDrives

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE