NEAS[.]c363354ab29a0b35c69e68d2ecdcf1e0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.c363354ab29a0b35c69e68d2ecdcf1e0.exe
Size

119KB
MD5

c363354ab29a0b35c69e68d2ecdcf1e0
SHA1

3bd2e8795f7399e39d5f564a7e1b55e51ef2752d
SHA256

2079db262f07647cff5280a1e1ebccbb14a5085a3c51aa845ba30376c7bfec7b
SHA512

b80c06ca12aa8f659bc8f706e2e2701be48eb8229fd90c34efd8df371507cac6ec9ced088df6ef6153931374942fdf602675e5935b121d73d47ae769f3dd6ff2
SSDEEP

3072:Ol/HwYE1b+vOILhwNWMtp6qre/ZlCg1aXFedgA:OlwYGNW2p6qre/ZlCg0Fqf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.c363354ab29a0b35c69e68d2ecdcf1e0.exe

Files

NEAS.c363354ab29a0b35c69e68d2ecdcf1e0.exe
.exe windows:4 windows x86

7614ab0e6332734913184c12a2dc4e8f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineW
TermsrvSetValueKey
QueryMemoryResourceNotification
GetMaximumProcessorGroupCount
InitializeConditionVariable
TermsrvDeleteValue
K32GetMappedFileNameA
FindFirstStreamW
GetTickCount64

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE