NEAS[.]54efeb9b4526624a067a6772fcfd5590_JC[.]exe | Triage

Sharing

General

Target

NEAS.54efeb9b4526624a067a6772fcfd5590_JC.exe
Size

66KB
MD5

54efeb9b4526624a067a6772fcfd5590
SHA1

f62270955c33c93eda8d70e49215ed1bae2a2fe0
SHA256

118e42bdc18b39414fdfb6a4b39589f53d2eeaeffb84b8ed329ef970f203472a
SHA512

3363b93185b212b7ba0b24ef7498d29b811e28682218389c888a265c5c53c647722e84977ba7ff1cce79f668f3a436f022c92a22a658bf05be5ef3a669c457d7
SSDEEP

1536:+f+5h6goW071MNSNxGGvSXvDj9AnPPRe7MCgqoncxC:+u6A00acHEXRAMCeOC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.54efeb9b4526624a067a6772fcfd5590_JC.exe

Files

NEAS.54efeb9b4526624a067a6772fcfd5590_JC.exe
.exe windows:4 windows x86

3f9fa9d2bf699aaad150d8ffc0a78689

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenState
CreateMailslotW
TermsrvConvertSysRootToUserDir
GetOverlappedResultEx
CancelWaitableTimer
ReleaseSRWLockExclusive
LZOpenFileW
LocalShrink
SetProcessAffinityMask
FindNLSString
GetExitCodeThread

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE