NEAS[.]488d48949833403732bb882d840d9390[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.488d48949833403732bb882d840d9390.exe
Size

119KB
MD5

488d48949833403732bb882d840d9390
SHA1

9c91d8a1c0d9691791662689cf5e50c47184d468
SHA256

8e53db9b7e493ecc9e0a4a54d0a418bba8603e03bcb7a5026a42289a25fb9e09
SHA512

b456137104e5dcea337e2f620c23c91c739355f953ab93586163068f1b6887093d69150c3a2da66c6ee7156e88efbf6c03d6c37bb8c189e08e9e828eca36209c
SSDEEP

3072:n45Zx/1DswNEQ7MeGJ52X9RaPPHZWLNaCFS:nqZxHNe52tR86g

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.488d48949833403732bb882d840d9390.exe

Files

NEAS.488d48949833403732bb882d840d9390.exe
.exe windows:4 windows x86

bf3a5466fe99dfa1c970c333e7d45127

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InitOnceComplete
GetCommMask
MoveFileA
GetCompressedFileSizeTransactedW
WriteConsoleOutputA
PssWalkMarkerTell
BasepConstructSxsCreateProcessMessage
GetTempPathW
FreeLibraryWhenCallbackReturns
InterlockedExchange

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE