NEAS[.]f1ab8303103f94f0f7e530a4bfbaa280[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.f1ab8303103f94f0f7e530a4bfbaa280.exe
Size

119KB
MD5

f1ab8303103f94f0f7e530a4bfbaa280
SHA1

89f308089357eb0b49f7a48512b3bda699885fbf
SHA256

882832b405e7273ba449b59ce460056613c078623be4b777b6cfcf82e52b2c78
SHA512

e0f8220f14226c209435fab8bfab124089895e989b2e3b9d7e6e4bf62e775b2894b9e5588e7da400e0ce00b55a8e4e408a1486c24734cf422f44b26c88db2531
SSDEEP

3072:AJkZBPv+lo6RM+vxoy7bByS+QAPxaROPp2QiOjQXyPAlu73:FPZN+vxoUAnaR83jQCPAlu73

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.f1ab8303103f94f0f7e530a4bfbaa280.exe

Files

NEAS.f1ab8303103f94f0f7e530a4bfbaa280.exe
.exe windows:4 windows x86

63cc85e1b2af1ad7e21274d5de7fd483

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FileTimeToDosDateTime
QuirkGetDataWorker
IsProcessInJob
DebugBreak
GetPrivateProfileStringA
GetNumberFormatEx
GlobalLock
GetNamedPipeClientComputerNameA
AppPolicyGetShowDeveloperDiagnostic
SetFileBandwidthReservation

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE