NEAS[.]6b1b4ec7e448a4adfef7546838722920_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.6b1b4ec7e448a4adfef7546838722920_JC.exe
Size

119KB
MD5

6b1b4ec7e448a4adfef7546838722920
SHA1

448df431673a44968dca6729023172029620fe9f
SHA256

a381236822f74f839694c7cbf8a25431426dd559b4be8d018430e09e168d06d4
SHA512

681607bcea87e54bf7a2e495f3a2f9e8bd3b70cb0fdaf8a06211a23f4a97fd2d786a88fe66f6ef75e53292c03a80c5f1066d33fa3ea35b4aea9bc9c955d0ca2c
SSDEEP

3072:qo93CdjA7rQksdn4qnIcLLuQNCazH2yo+2XAs:qo77rQkKrn9Wo0lQs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.6b1b4ec7e448a4adfef7546838722920_JC.exe

Files

NEAS.6b1b4ec7e448a4adfef7546838722920_JC.exe
.exe windows:4 windows x86

3672623ded39585f3860da7b7c72bf55

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileMappingFromApp
K32EnumPageFilesA
SetTermsrvAppInstallMode
PssQuerySnapshot
GetPackageFamilyName
GetNumaProcessorNode
CreateMutexW
BaseFreeAppCompatDataForProcessWorker
NlsWriteEtwEvent
GetComputerNameExW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE