NEAS[.]5c3866303ace6e28ee100f289f186740[.]exe | Triage

Sharing

General

Target

NEAS.5c3866303ace6e28ee100f289f186740.exe
Size

119KB
MD5

5c3866303ace6e28ee100f289f186740
SHA1

c7746b6f6555faa32e2371676673de93fe308345
SHA256

a95934ecd73c9e66eedd82fb2763381c8b41e0d93f668efd0f19c8203fe09a6a
SHA512

8ced7f10e506d4d606807a0d639bdaae73d1b719106d1ab84e4f479470ff6d1628a323d67ec6cd5da31f91521e05257c789ec31ec56f8cdac231ec1790fb4435
SSDEEP

3072:SewXE2rg+dxbqhlzYpB0nhx32CWggOq8LZu2W9:SekVjdxbqhlEanz/WgguLZ5I

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.5c3866303ace6e28ee100f289f186740.exe

Files

NEAS.5c3866303ace6e28ee100f289f186740.exe
.exe windows:4 windows x86

0ec73cec6222011a381ac5682d2d78ea

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindNextVolumeMountPointW
CreateProcessA
FillConsoleOutputAttribute
ExitProcess
lstrlenA
FindStringOrdinal
FindPackagesByPackageFamily
CreateTapePartition
PssWalkMarkerCreate
CancelDeviceWakeupRequest

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE