NEAS[.]3e5458431926aac7d02eb0ec7f4d66d0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.3e5458431926aac7d02eb0ec7f4d66d0.exe
Size

294KB
MD5

3e5458431926aac7d02eb0ec7f4d66d0
SHA1

a4fdf052070267c79a57f8444fb3b97851d00d52
SHA256

6ee0e98c08edeee07bfe2110bb8b30acd5065db2af30733438ffa282f810d6a0
SHA512

b2608722739eb07a22d40f6dfa4ba3fbd394208e5fad0c60a511feebe3d9a78bd33d79fa0ffc9550a8d11fa0686e93c77f6dfd7c3f1bb47883e74838b4306a00
SSDEEP

6144:RKcnNV1WBENvtVjeSdd7R7Sy0IOq4nXRRmHVFql8ynOxkK:Ucnr1EsSS3R7SyDzSRwVEdOD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.3e5458431926aac7d02eb0ec7f4d66d0.exe

Files

NEAS.3e5458431926aac7d02eb0ec7f4d66d0.exe
.exe windows:4 windows x86

c0ca8fb524d53a294a75f3adfde9e816

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
VirtualAlloc
GetProcAddress
LoadLibraryExA
GetModuleHandleA
VirtualProtect
ExitProcess
GetModuleFileNameA

user32

MessageBoxA

Sections

.data
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 279KB - Virtual size: 279KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_rsc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ