NEAS[.]cf17345b0d7b6a9bce339c43476416a0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.cf17345b0d7b6a9bce339c43476416a0.exe
Size

119KB
MD5

cf17345b0d7b6a9bce339c43476416a0
SHA1

c7e7aec54bdfc72e10444356420caabc2b336a9c
SHA256

6df43537a13532e90baf8beb73b58c62d0efd5b30f880dfd1176ff56ab3a165e
SHA512

9cfd479d1a9d524451cecddfe19c88adb216110d5c8169a5eca047cdac5e53dfc354fd2123115c1fc39f71eb569ed6ae56fd09f2b88d3eee745d47095000dcb8
SSDEEP

3072:1FOUbCT7ozh/aLYTiTg/NiAFcP3jz1p0hWr4xGbXf/5+:rrFBmYuOGD0YVLE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.cf17345b0d7b6a9bce339c43476416a0.exe

Files

NEAS.cf17345b0d7b6a9bce339c43476416a0.exe
.exe windows:4 windows x86

fbd3f83f4752814d9912112010ab8b4a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenJobObjectW
DecodePointer
CopyFile2
ZombifyActCtxWorker
Module32FirstW
GetConsoleOriginalTitleA
InterlockedPushListSList
WerUnregisterFile
CreateSemaphoreA
GetVolumeInformationByHandleW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE