NEAS[.]08ffca97b3383d739d23deb971d56270[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.08ffca97b3383d739d23deb971d56270.exe
Size

119KB
MD5

08ffca97b3383d739d23deb971d56270
SHA1

7ee15c83ba2ae8ea90246c019becf7185f1ae395
SHA256

8a508d6c9b5bfb611d1763cba7044a9f46160ff9dd67e579bafbcce75215bb3e
SHA512

d91b45eb22013ccf2e01a5a215c706f1ee0e285e1d98be45ea502b67581484c50be9463aa21a507e48ec4c25d73f140210e5234241c828a16aecef26160af58a
SSDEEP

3072:y33Eio8jTyULI6wEE3chHaFUOcwofBFH3bu2IB/Wq8D+H4gp:ynEiBTlVwEE3chH8UOcwYfdirahu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.08ffca97b3383d739d23deb971d56270.exe

Files

NEAS.08ffca97b3383d739d23deb971d56270.exe
.exe windows:4 windows x86

7c442a0856a5ab1075a1899a3af5fd79

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeUserPhysicalPages
GetProfileIntA
SetConsoleActiveScreenBuffer
IsBadReadPtr
BasepAnsiStringToDynamicUnicodeString
IsValidLocaleName
Module32FirstW
IsBadReadPtr
GetDiskFreeSpaceA
DeleteAtom

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE