NEAS[.]0d8a92d89587c229448d4f82c8e18b40[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.0d8a92d89587c229448d4f82c8e18b40.exe
Size

119KB
MD5

0d8a92d89587c229448d4f82c8e18b40
SHA1

f6fe7fcf6312784e827fd9514141a88a7a018d1e
SHA256

522ac2cdd9877fc08353806ba356d0080a6a676a0a4efb1d290e3b2bdd6ad4d3
SHA512

a2849154651929b3223f86cd776c70175909c6704a7db592aaead869efae1d3802611cfdb365310ee7dbb98fc6f7f8ee5d581e19325af11cab0007de9ced752a
SSDEEP

3072:K16eXnqpespVBUsuxKqA3u7TjNqhhf3yfmXqt3R7p2+u62mzJ:KEeXAdUhG3u7Nqh932K6y+5tN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.0d8a92d89587c229448d4f82c8e18b40.exe

Files

NEAS.0d8a92d89587c229448d4f82c8e18b40.exe
.exe windows:4 windows x86

71708bb57e4c007e2c79073dc5240805

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStartupInfoA
DosPathToSessionPathW
QueryIdleProcessorCycleTimeEx
GetCommModemStatus
IsBadCodePtr
DisconnectNamedPipe
CreatePrivateNamespaceA
RegisterConsoleOS2
GetDateFormatEx
CloseHandle

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE