NEAS[.]c69af43c684ff5f7587139809b267010[.]exe | Triage

Sharing

General

Target

NEAS.c69af43c684ff5f7587139809b267010.exe
Size

66KB
MD5

c69af43c684ff5f7587139809b267010
SHA1

4c2b8237f39a1aafe6478a8413985f77621fa419
SHA256

b0b2f78b5c7ba3a81dbcbfd97883dea6c0b94aeabf47fedd9e8a5bcb44424289
SHA512

813ec0f246c5e279d4e1b7b1fd9a31cd57eebf3f50331776ab11a07b5ad462e48e366b070a3a7909bed4429f312e32bb8017b5ce68f5d48b75cf99606216ef43
SSDEEP

1536:RAoM4QdHMlEktg4aN4qtJRxbVPspMtHOEWfRGo45gJzb/Vy4rk:RAp4GslEkymkJBPsC4P5Go4eJH/wEk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.c69af43c684ff5f7587139809b267010.exe

Files

NEAS.c69af43c684ff5f7587139809b267010.exe
.exe windows:4 windows x86

acba2b4e7ccee3cab01c6646aa081ae4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReplacePartitionUnit
GetFileAttributesTransactedW
CreateSemaphoreExW
RegEnumValueA
SetVolumeMountPointA
WritePrivateProfileSectionW
GetQueuedCompletionStatusEx
GetStateFolder
UnregisterConsoleIME

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE