NEAS[.]ed5b368b8311fd5c6dd1920a3895c740[.]exe | Triage

Sharing

General

Target

NEAS.ed5b368b8311fd5c6dd1920a3895c740.exe
Size

66KB
MD5

ed5b368b8311fd5c6dd1920a3895c740
SHA1

30075a79cd54b505dc5aa3242f6181d59a5780a7
SHA256

f20f2db9cc29a0fe55bee155a8c40913c28887b4d752b64d0c7187358739f7ac
SHA512

3f8c68bb262ea84940c6d315f54b4930f225c4648c0509ea234e74a579b422cdb246cac2bc8ea9fe22e86aafc29fd3d3a9631be13953d03b8e15d87b26f9dcc8
SSDEEP

768:vQFSrugMRYYRRFsz4aBU3ajU39oJLFBGG0tNeG97beETVi0vplfK+fPyOXW4w2Aq:riVsnU3GF0G0tUCeE5Txfin/m

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.ed5b368b8311fd5c6dd1920a3895c740.exe

Files

NEAS.ed5b368b8311fd5c6dd1920a3895c740.exe
.exe windows:4 windows x86

97cb1be3768300188fff3d7cd05d1e63

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

UnregisterConsoleIME
GetSystemDEPPolicy
MoveFileWithProgressA
WaitForThreadpoolWorkCallbacks
GetNumaProximityNode
DeactivateActCtx
InterlockedPushEntrySList
GetFileAttributesA
HeapCreate
GetPrivateProfileIntA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE