NEAS[.]6e2529334ca554b7c6a4037a518e8b70[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.6e2529334ca554b7c6a4037a518e8b70.exe
Size

119KB
MD5

6e2529334ca554b7c6a4037a518e8b70
SHA1

cc003aa5c107ad8197cea39f248c2827af4bbb90
SHA256

fc4db18a0b6abe989746aa17875aadfbc3174e8f1d0110b499c1fa8ba15a9717
SHA512

df628ea1b07e9123a331175e3cd27a24ce2bc85cf0122c925c0909baf830ad8b1eacb864f8aee1fe5728ed920f02ca53d4413a3e06eee7ed53df2942e0ae43e2
SSDEEP

3072:icPWiLeSCPgvWdsLO9c95hjqYV20VutxW6PwE:icP9SXPg+eLOy9DjquYxW63

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.6e2529334ca554b7c6a4037a518e8b70.exe

Files

NEAS.6e2529334ca554b7c6a4037a518e8b70.exe
.exe windows:4 windows x86

4f90731ae015a12c38f43e794e268c01

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Heap32First
CreateTapePartition
SetFileAttributesA
VDMOperationStarted
GetExpandedNameA
BaseUpdateAppcompatCacheWorker
K32GetWsChanges
GetFirmwareType
DeleteAtom
FindNextVolumeMountPointA
ZombifyActCtxWorker

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE