NEAS[.]0e54a6a1109ef045b9e59c5ed0c2c760[.]exe | Triage

Sharing

General

Target

NEAS.0e54a6a1109ef045b9e59c5ed0c2c760.exe
Size

119KB
MD5

0e54a6a1109ef045b9e59c5ed0c2c760
SHA1

b7c7893b5d0b1d8fa83bef1d0e94e309ad333000
SHA256

f039339743950f80a29c5002d7a4f8a6a8eace84b77d0e11a15f665ab2c9d15f
SHA512

334f14377d75fd4005b0b9218e9001b1a020db6faa38ec03dd6d999654b7c9cea25d4a55d957c494dc65383f05968d72a0e1ad7b734109576bac545bb3cfd4d9
SSDEEP

3072:BZNxD7B36rXIr2eYxNOUyjOUAz/s3W4xgiL5oKdvt:B17967ICeAOXjc/smSgindvt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.0e54a6a1109ef045b9e59c5ed0c2c760.exe

Files

NEAS.0e54a6a1109ef045b9e59c5ed0c2c760.exe
.exe windows:4 windows x86

45decd28fb4dd70b7bb9b32623c99582

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WerpNotifyLoadStringResourceWorker
GetCurrentProcessId
SetFirmwareEnvironmentVariableA
IsWow64Process
SetWaitableTimerEx
WaitForMultipleObjectsEx
SetFileCompletionNotificationModes
GetFullPathNameA
SetNamedPipeAttribute

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE