NEAS[.]61fe9f17600c7ad777d1efa13457e570[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.61fe9f17600c7ad777d1efa13457e570.exe
Size

119KB
MD5

61fe9f17600c7ad777d1efa13457e570
SHA1

a4928c1cf80e5743f66c570fb03b9f038838e2ce
SHA256

afbf62d7a47a1b11f9702491e9c4a7fc8a7b876f05cdca1f5e33352514984acd
SHA512

282273be7c8ad50c2440973ffc1e7f85fee8770933891176b6f73be253a4eba556b43b23cc955efe21feed2d7fb20363ce8c49e6e3e96641ac4bc227cc49c887
SSDEEP

1536:gEJXxQPULAdQnnrcZHnr9iLCpAw9ellJLlWSNYkoUWo3Pom0rPY8QZXQ9E3k2rk2:pJhNckrUHr09w9mzYvTo3w39E3drpP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.61fe9f17600c7ad777d1efa13457e570.exe

Files

NEAS.61fe9f17600c7ad777d1efa13457e570.exe
.exe windows:4 windows x86

c64d170aa854aa59bfcf330a056dee7e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFirmwareEnvironmentVariableW
HeapLock
StartThreadpoolIo
GetAppContainerNamedObjectPath
SetThreadLocale
GetVersionExA
GetThreadTimes
ReleaseSRWLockExclusive
CloseThreadpoolTimer
ActivateActCtx

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE