NEAS[.]678455607846d4c01571459e56245b60[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.678455607846d4c01571459e56245b60.exe
Size

66KB
MD5

678455607846d4c01571459e56245b60
SHA1

ec8ab23ef64d5bd90b8fa7eed1947d099b3e0c02
SHA256

ee2e352b430eb41cc760c0a9b7609d47fab3216de4118e7197d37cc56d7a29d6
SHA512

5a20e8c9b9b57c0bd5e3ff108d6d30d2c57fda9b24b106eabb877c84a672bba4e5be30414a44a42f0999df82e6b3d0eb29af06f8c0cd97736a4e0c347777478c
SSDEEP

1536:+mrfqsjyUefnIaz4EsGA0HA0Q/nB9/BsXs6kXCprSF+X0/X38c:bfzmpQa5GduXsFBQkkc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.678455607846d4c01571459e56245b60.exe

Files

NEAS.678455607846d4c01571459e56245b60.exe
.exe windows:4 windows x86

08511ba2e7166872141ea09f2eb3b92a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcessWorkingSetSize
SetThreadpoolWaitEx
MapViewOfFile
AssignProcessToJobObject
WriteConsoleInputVDMW
CreateSemaphoreExW
GetBinaryTypeA
WinExec
SetUserGeoID
TermsrvDeleteValue
GetNamedPipeServerSessionId

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE