NEAS[.]d782c5371dd4d250ad03d53136ab3250[.]exe | Triage

Sharing

General

Target

NEAS.d782c5371dd4d250ad03d53136ab3250.exe
Size

119KB
MD5

d782c5371dd4d250ad03d53136ab3250
SHA1

0acd5ba450eea893dc899edb5bf29508d808f971
SHA256

ee7549b8af37797175203300f95f14c66ee65e6eaeb725fd3c39f87d16c14c89
SHA512

67098ed2b544a085807cc45a2ca3eebc1d098916496218a330dd2fffbe6ee4998f83e1066c6fc74ca2793a3fad284a77645bd428b7c21e27e962d6180669e824
SSDEEP

3072:GMJ+Rwz9VI2mS3+wp8aE+K7ynvoywAVXaUTrq7SG3OaNz0yF:h9VanmE+KUrwSaa+SG3OaNz0A

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.d782c5371dd4d250ad03d53136ab3250.exe

Files

NEAS.d782c5371dd4d250ad03d53136ab3250.exe
.exe windows:4 windows x86

188817c19c89aba476b996dc8215509b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

K32GetModuleBaseNameA
IsWow64GuestMachineSupported
GetCurrentDirectoryW
VirtualQueryEx
GetDateFormatA
LZCreateFileW
GetDiskFreeSpaceW
CheckForReadOnlyResource
GetApplicationRestartSettingsWorker
FindNextFileA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE