NEAS[.]6a9b46bfba2d1d48f33c36fbe4c1aa80[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.6a9b46bfba2d1d48f33c36fbe4c1aa80.exe
Size

119KB
MD5

6a9b46bfba2d1d48f33c36fbe4c1aa80
SHA1

1440596ad2320fae18f637b9e088d850d54f9fb9
SHA256

eb8c1f94b0e9e48ae4288af1b0753810bd4e1b9ca4689200a82a8c3def001eb2
SHA512

c8b78be04765f5a2d4f5f595eaf1d6344e1897713f7a7d24b8fdd48da83fedcc7de1fb885b3fc17f832033b0e57188f979aab1a0f68c049358035807e0b03566
SSDEEP

1536:1mXtzAxNRiOjZNpkioxk5HK+HC7nqBZ6708+WwAs5yGX+d975F1ct1GkGu6wROhs:1m90xNRigzpk5Co+HJZieydfc01TmP17

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.6a9b46bfba2d1d48f33c36fbe4c1aa80.exe

Files

NEAS.6a9b46bfba2d1d48f33c36fbe4c1aa80.exe
.exe windows:4 windows x86

7511a1876ff91f7ff6b7292e80a5c233

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

QuirkIsEnabledForPackage3Worker
SetConsoleCursorMode
FreeEnvironmentStringsA
RegQueryValueExA
NlsWriteEtwEvent
GetConsoleHardwareState
Heap32ListFirst
lstrlenW
DisableThreadProfiling
SetComputerNameExW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE