NEAS[.]24358e215e61e40c044ed95b29879070[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.24358e215e61e40c044ed95b29879070.exe
Size

119KB
MD5

24358e215e61e40c044ed95b29879070
SHA1

3a7b27ee6c288af4db7cc4af35e1a18de462c22d
SHA256

13b2496ff59f08e6655d4f0a706746547548769b6611264e5715a0969e995fab
SHA512

10559d281a02bf4b2b861d505944c0bc1c20995ea6b476683403febb9c5e09f0d2d2677b3992f6c7d5f99de82d1425139318276c8e97ee26724ef77ba06b51e5
SSDEEP

3072:PzMLGifnA/0C3D+9NXsMvZAl2mVFG+TBjY6/k254ZMCyI9:R/0C3DehsMvZJ88yY682E9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.24358e215e61e40c044ed95b29879070.exe

Files

NEAS.24358e215e61e40c044ed95b29879070.exe
.exe windows:4 windows x86

239cb3280031f536124a8425be3044f0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCPInfoExW
CloseThreadpoolIo
SetIoRateControlInformationJobObject
GetProcessWorkingSetSize
CreateThreadpool
SetCommMask
ExpandEnvironmentStringsA
InitOnceComplete
FlushFileBuffers
DuplicateHandle

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE