NEAS[.]2f3d7e2f94cdf34e3d5a51b482848270[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.2f3d7e2f94cdf34e3d5a51b482848270.exe
Size

119KB
MD5

2f3d7e2f94cdf34e3d5a51b482848270
SHA1

c749c8bff1aef43e2b6414ffc6ae07438e03cafc
SHA256

51a40c6cab86c76199d542e1ba8e4a957c4882c9babb6c3cbc0447755b9e952e
SHA512

0cdb89e719250beb3636e2535c5015fb1c7a684d35518eddbaf9539e157ea4169b5e4d7927d2fb0aeecd697b2708085568fbd5b8cc196653013779c421f050a4
SSDEEP

3072:UEc5wUYxzn+yCCfdq0zkMSPa1zOjmENAphQ4+hV:U7szDCCf/v4myYF+D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.2f3d7e2f94cdf34e3d5a51b482848270.exe

Files

NEAS.2f3d7e2f94cdf34e3d5a51b482848270.exe
.exe windows:4 windows x86

a65356c6f63d3868f56f790941b0a9d1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WerUnregisterExcludedMemoryBlock
GetFileAttributesTransactedA
timeGetSystemTime
AcquireSRWLockExclusive
GetFileAttributesExW
DeactivateActCtxWorker
WerUnregisterAdditionalProcess
GlobalFindAtomW
ReadDirectoryChangesExW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE