NEAS[.]5843466643052f46b7bd6e4cc9952960[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.5843466643052f46b7bd6e4cc9952960.exe
Size

119KB
MD5

5843466643052f46b7bd6e4cc9952960
SHA1

a7b89f951eb73c4cf37ae44b16641c801cc6bc46
SHA256

1014dc0b45cbbc6e564736192147c023ea3e6668b5135ca9ec7de055b4665f5a
SHA512

c619a6d7f5bcbf72097b6f811701035ee63c8fd0966ccfe5da77cc26661a29f8617784ea45ab6bc64ae9892e76e893735a2b3203a2308852c4716e75da8e3d99
SSDEEP

3072:QONr3TNqyYjw2Z62p0Q12M6ovQoIwQiuNCTe5QJYvwny+:f5BWVeQZVQJwCNl8YIy+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.5843466643052f46b7bd6e4cc9952960.exe

Files

NEAS.5843466643052f46b7bd6e4cc9952960.exe
.exe windows:4 windows x86

b3c6e7dd1289cdc47ca5ffc10b5e7551

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcmp
BaseSetLastNTError
FindActCtxSectionStringW
K32GetModuleFileNameExA
GetProcessDefaultCpuSets
WaitForDebugEvent
OpenProcessToken
_lread
CopyFile2
GetThreadTimes
CallNamedPipeA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE