NEAS[.]7e2a19f5e50f401b30da124134863e00[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.7e2a19f5e50f401b30da124134863e00.exe
Size

66KB
MD5

7e2a19f5e50f401b30da124134863e00
SHA1

6994e49376bb9e4f06892155f6f76b99fc9c84fe
SHA256

dd3e1bb92acc822af8e8d0ccb7ab3556d47f9ff4ff289dd5a296065cd62d7fcd
SHA512

2782d8d3109df52370f9474edf8d31cf9734ba467f072fc020fc142ef814e052556fb411b61e710afe14ae5ca7f6fdc09a3d5191ed720da27ea609096d943d86
SSDEEP

1536:YHgTf278sQDv20HX9d8QnE4JG50X1K5NXstaMWqubzb1:YATN55HtFEj2F8GR2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.7e2a19f5e50f401b30da124134863e00.exe

Files

NEAS.7e2a19f5e50f401b30da124134863e00.exe
.exe windows:4 windows x86

aef559bdc731f1e80f008fe2b1e0cd27

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetOEMCP
GetComPlusPackageInstallStatus
RegFlushKey
GetPackagesByPackageFamily
Toolhelp32ReadProcessMemory
GetModuleHandleW
GetDiskFreeSpaceExW
BaseIsAppcompatInfrastructureDisabledWorker
ZombifyActCtx

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE