NEAS[.]e3c5bb3e75a03c024d13801f08d30570[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.e3c5bb3e75a03c024d13801f08d30570.exe
Size

119KB
MD5

e3c5bb3e75a03c024d13801f08d30570
SHA1

6e53a382b98f9d89f25c935dbaf95a23af471175
SHA256

3c467fd8bafc038dab59f61718d1e6603bd7c9a4c82485c6659b20e38d8a2049
SHA512

930e8210d9346b921f8f322fdafdca48b5961907f16bbc35acc924d0b8b231873056238ed55d6ae413764e0ee552c4a02540b032728159922c719308208f2572
SSDEEP

3072:9baxzPuVSzLJu+3J6ptIW3YbDNsFYbnSqOi/lzs:9byzPuyL0vEW3Y0YT/dQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.e3c5bb3e75a03c024d13801f08d30570.exe

Files

NEAS.e3c5bb3e75a03c024d13801f08d30570.exe
.exe windows:4 windows x86

e549808e4244504a74f334342cb13eb5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RaiseInvalid16BitExeError
SetThreadpoolWait
HeapSummary
CreateThreadpoolIo
GetSystemDirectoryA
FindActCtxSectionStringA
CreateFileMappingFromApp
GetNumberFormatA
OpenJobObjectW
QuirkIsEnabledForProcessWorker

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE