NEAS[.]20548d8ca9a56bc246ef851d5fb78560[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.20548d8ca9a56bc246ef851d5fb78560.exe
Size

119KB
MD5

20548d8ca9a56bc246ef851d5fb78560
SHA1

7af287dc9eb9e3ec68a51ee249056f5b57f39989
SHA256

5106fee7b2d01c9034888d7a6804bd9f4582bd26cee97855a3280b4d7b223030
SHA512

86e9ddaec48f10f26370bd66ba3dcba8ddf76be22b46ed065ae41e7dd780b41ada7515b5e20ddbc88140609749739a2380d290842f64ecbea9bb08c103331672
SSDEEP

3072:n/0W7MCQlzYXzhVFmcWm+S/NMuPZxDcIcEFN99KWM:nR8RkzhVFmcH/OyfwQ/ZM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.20548d8ca9a56bc246ef851d5fb78560.exe

Files

NEAS.20548d8ca9a56bc246ef851d5fb78560.exe
.exe windows:4 windows x86

7d48abbe53f795a539dc286f164b6379

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetVDMCurrentDirectories
SwitchToFiber
K32QueryWorkingSet
GetStartupInfoA
BasepFreeAppCompatData
Module32FirstW
MoveFileExA
LocalCompact
_lclose
K32EnumProcessModules
SetCachedSigningLevel

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE