NEAS[.]15b4b6d2faa5c7f6a8611aadd98a6470[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.15b4b6d2faa5c7f6a8611aadd98a6470.exe
Size

119KB
MD5

15b4b6d2faa5c7f6a8611aadd98a6470
SHA1

274fb046d574103fe498102ff4afef6173aa97d2
SHA256

3e7c7ecacf1861d599790b565155be78922bab5a5ae92376a93082a025139932
SHA512

890c9be1803cebd950617ec2029b947f9209f793aa0082489c30b7f15af82c54fc1922ee66d80d61a4780c2deaae4a87275f5a55dfb222fb21adfb5ae45b1997
SSDEEP

3072:eVPLmko0aq9HR1Jkhc0Q1eS6cF28l0/qeNl:AVo0j9HR/kh9QwSXc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.15b4b6d2faa5c7f6a8611aadd98a6470.exe

Files

NEAS.15b4b6d2faa5c7f6a8611aadd98a6470.exe
.exe windows:4 windows x86

ca984d147f8f49e9f00d399e1f4cacc0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenJobObjectW
GetOverlappedResult
SystemTimeToTzSpecificLocalTime
CopyContext
VirtualQuery
BaseDumpAppcompatCache
GetFullPathNameA
Module32NextW
CreateProcessInternalA
QueueUserAPC
VerLanguageNameW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE