NEAS[.]96381e032cb6136075c123adbaee6680[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.96381e032cb6136075c123adbaee6680.exe
Size

119KB
MD5

96381e032cb6136075c123adbaee6680
SHA1

3a9aa541fc82575d0a3d1485a2a9bf4ee4810042
SHA256

20c6b07a6c262cafeca6da9175ef6015e5b4da6efc1996e347790e2038944a45
SHA512

edc15403cd986c8cdb7ecb8849cfebcf98fef2486d2e2db21d7b6e2fdf52b1af184ee48ac728fb97c314778236a43e7636dfc580cf117d305af1259545c25ef1
SSDEEP

3072:aExCvv0QoF7aUVb2rIsA5aM7LKUZ30fZqoCCJPOss8/VmA:JxCkjLb2rIs/UycCJDs8t

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.96381e032cb6136075c123adbaee6680.exe

Files

NEAS.96381e032cb6136075c123adbaee6680.exe
.exe windows:4 windows x86

947989174bfe5eb5d1b6a7b7da097ed6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetDateFormatAWorker
IsProcessInJob
BackupSeek
RegSetKeySecurity
CopyFileTransactedA
ReleaseMutexWhenCallbackReturns
IsBadStringPtrA
FreeLibraryAndExitThread
LZStart
AppPolicyGetProcessTerminationMethod

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE