NEAS[.]dc174016613fb2e82423508dcdac4620[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.dc174016613fb2e82423508dcdac4620.exe
Size

119KB
MD5

dc174016613fb2e82423508dcdac4620
SHA1

546dbc03d9085a6e6c9d8b195ae1ddb04d0f0068
SHA256

ffe7e118159cb6af776800dcc32419d6ad2b24d6272fdfbecf084a3c584af729
SHA512

ec69646022fe74820966ea879866765a83d4f2758bbba714a7396c715f13924e370546e6a9917f9129f2c87d9ea6a944ff6136587d46527adaabbd07fad7f1ab
SSDEEP

1536:v/sefMDqTTyNwRlGPaiRV+kXW5afM6pr1qsXbcfKk8eLWGJt3m/S911Eee22svQz:vwaQOuxlG1oHxNOjomtuAIvRv6DhVxw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.dc174016613fb2e82423508dcdac4620.exe

Files

NEAS.dc174016613fb2e82423508dcdac4620.exe
.exe windows:4 windows x86

8b43cb0b90a9fc28de688e4874b70e67

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

PssDuplicateSnapshot
LZCreateFileW
CreateFileA
FindResourceExA
DeleteSynchronizationBarrier
Module32NextW
ReclaimVirtualMemory
CopyFileW
EnumResourceNamesExW
QuirkIsEnabledForPackageWorker

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE