NEAS[.]c2e5e8ce4431547377ddc3677a2cf200[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.c2e5e8ce4431547377ddc3677a2cf200.exe
Size

66KB
MD5

c2e5e8ce4431547377ddc3677a2cf200
SHA1

886041aad528c30c6f6417406ea7a429e806549e
SHA256

a93ddf1bc44cb011f64ad337c7645e7c850650818336fb30ba6517271e2e470b
SHA512

81837b5ff26a1fda496d1d041d9e5bc60f79eedcad070c1fe8e4794aae4561a47ee2412b28f4b7f2f588f4e508b425b24ea3dc447f31c66ff8fea167e38361d3
SSDEEP

1536:SxS8eE+5PP7jAxRnWQkX35rtDNsK3OfOmeTvsRApxXRyDa8/2UPF8grp:+aE+5PP7jAxRnWQkX35rtDNsJfTeboA+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.c2e5e8ce4431547377ddc3677a2cf200.exe

Files

NEAS.c2e5e8ce4431547377ddc3677a2cf200.exe
.exe windows:4 windows x86

1a4e700122d57069dcae476c304bfa6a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InterlockedCompareExchange
OpenPrivateNamespaceA
GetNumaProximityNode
VDMConsoleOperation
EnumResourceTypesW
BaseThreadInitThunk
DosPathToSessionPathA
WerUnregisterCustomMetadata
WaitCommEvent
InitializeEnclave

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE