NEAS[.]695ab01f23eacca9d86129966202eb20[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.695ab01f23eacca9d86129966202eb20.exe
Size

66KB
MD5

695ab01f23eacca9d86129966202eb20
SHA1

5f91b6f4dd7143d4c668034e9dadbaf9106b1957
SHA256

3046eed59e884195f4b05712ee3311b89207d009b71354a788506a9915ca8eb6
SHA512

ddae03ec2da0f9d7bad3d307e2bb1bfc57ddd3336c4a25b4fda8939d6ee2c8196f4ab8033a8067b7301d6bae44fc6f0a118a551c86812748e2a45849439d0db6
SSDEEP

1536:cVPxd8JBW96joSjEuCt+84bTX3Hsb6l5al5Tum8S+SfAlAm23y/x9d+Ru91StPra:64roi9igL5ORKkna9zd31BZyU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.695ab01f23eacca9d86129966202eb20.exe

Files

NEAS.695ab01f23eacca9d86129966202eb20.exe
.exe windows:4 windows x86

008e70cb47dcab2dcd88bef70f829412

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeviceIoControl
RaiseInvalid16BitExeError
RtlZeroMemory
AllocateUserPhysicalPagesNuma
VirtualProtect
MoveFileWithProgressW
ConvertSystemTimeToCalDateTime
GetWriteWatch
Thread32Next
RegFlushKey

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE