NEAS[.]d6f4bc0511e98309f1048d7c4aff2590_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.d6f4bc0511e98309f1048d7c4aff2590_JC.exe
Size

119KB
MD5

d6f4bc0511e98309f1048d7c4aff2590
SHA1

f897c9466c5d7abed7d955926e2faad3ddbddf9e
SHA256

8f3e17c5c64bb00750f6904fe7660dc5d9075cd809b41e70be1c7c3c0a0d06c9
SHA512

8ab473680b072281c86399a60ff2f2422a158f9009ce00df1b854448be8b7de29d36b40549b424c30ed6cac4c398461f23fb825c85de24a1628948ebdc7c39e2
SSDEEP

3072:Z7sLa9zR8c/5UZHpmj5ZK/GBbdG2xQaFdiZxfe:CLGJOVUj5Zn5ca76fe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.d6f4bc0511e98309f1048d7c4aff2590_JC.exe

Files

NEAS.d6f4bc0511e98309f1048d7c4aff2590_JC.exe
.exe windows:4 windows x86

d9ca24909561b3740e851a4171ea4045

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
GetPackageApplicationIds
GetCurrentProcessorNumberEx
SetFirmwareEnvironmentVariableExA
QueryPerformanceFrequency
GetCompressedFileSizeW
CreateEventExW
CreateNamedPipeA
AddRefActCtxWorker

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE