NEAS[.]3cdd430a203e3527a54422b40d7aab10[.]exe | Triage

Sharing

General

Target

NEAS.3cdd430a203e3527a54422b40d7aab10.exe
Size

119KB
MD5

3cdd430a203e3527a54422b40d7aab10
SHA1

145a7023851aeb1199dc4f4ba9ef15dec8490aa4
SHA256

74d4b2c076ec3895aaface8f9aac4c444d372b0dcd6732ee145534f0e5f73849
SHA512

cb8b742a5da07828fe93d29b4c0a4a79119ba40ee01f9a2e990a0cde8c927af91c7a5ce9ac1845fd205f80bd8ddf896c2d8f7b848b7b184efa99fb3468e4e65f
SSDEEP

3072:bdHNS53mdjDsVtgEAM37jHKasmXrv/eZgm/PXdzHxigLys9D8PyX3:b+ejUV7jH5sm7vGxnXTigLAyn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.3cdd430a203e3527a54422b40d7aab10.exe

Files

NEAS.3cdd430a203e3527a54422b40d7aab10.exe
.exe windows:4 windows x86

2d9b27f75884b8775f5c9e22e99c520a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpy
GetProcessPriorityBoost
CancelIoEx
Process32First
FindFirstFileNameW
ReadFileEx
GetOverlappedResultEx
CeipIsOptedIn
GetNumaAvailableMemoryNode
BaseIsAppcompatInfrastructureDisabledWorker

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE