NEAS[.]5c8bb6afe58a7d0352f9c56ff0a9b940[.]exe | Triage

Sharing

General

Target

NEAS.5c8bb6afe58a7d0352f9c56ff0a9b940.exe
Size

119KB
MD5

5c8bb6afe58a7d0352f9c56ff0a9b940
SHA1

d09dd65ef068095811d4037516ab5097943a1717
SHA256

7ceee92b55b6912fd2ebea7c96a2993320991b42385487a28d11250a5b5a31f0
SHA512

048a630df1ba9e8f8ef81775f296dfbf571bd78394bf62bf95d39fbd293db28e04c90d714d8107195eb20289a8108255127e9bf6cfd9c33c5ed57b7bddd5be25
SSDEEP

3072:LA4Yy2EO4n205PUTmwsUK1NmqRQJ3mlDSpWgvRapM:LA4jO4n2APEsUYmYQJ3mlDSbeM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.5c8bb6afe58a7d0352f9c56ff0a9b940.exe

Files

NEAS.5c8bb6afe58a7d0352f9c56ff0a9b940.exe
.exe windows:4 windows x86

6060a01896a2058d0685e83e63397092

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetDefaultDllDirectories
GetConsoleWindow
ConvertThreadToFiberEx
ExpandEnvironmentStringsW
ZombifyActCtxWorker
TlsGetValue
PackageFamilyNameFromId
GetStagedPackagePathByFullName
DefineDosDeviceA
ExpandEnvironmentStringsA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE