NEAS[.]0a51190dc6b90be96e18c6ca9acd6eb0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.0a51190dc6b90be96e18c6ca9acd6eb0.exe
Size

66KB
MD5

0a51190dc6b90be96e18c6ca9acd6eb0
SHA1

d7e5c36d1eab0f21783494a04e0078f4894b29bb
SHA256

125a3fec78954ff42a4447772f77e1891c9bc211445e1d95edcdcfcf3e638a99
SHA512

3616b92619a112ae7244e286101a946fbfba55d62372a7a4e65cba2fb3122487633bc1be9edee3d421398d899fc2b2d9c33896d808ee086bf3187149f2cc39ef
SSDEEP

1536:KBK5nTeJ7VHAMWHQaANG/ICf1ndQWu7oQzguWCorbjkXkiEz:KBhJ7lATQaANG/IK1Ju7ouguyboUiEz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.0a51190dc6b90be96e18c6ca9acd6eb0.exe

Files

NEAS.0a51190dc6b90be96e18c6ca9acd6eb0.exe
.exe windows:4 windows x86

564662b3965d5a501d4f2bd01e696dfe

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindClose
GetProcessShutdownParameters
OpenProcessToken
GetConsoleAliasExesW
RegOpenUserClassesRoot
WerUnregisterFile
GetExitCodeProcess
SetFileAttributesTransactedW
WerRegisterFile
Thread32Next

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE