NEAS[.]638c870c29122cb27e0038203e3edd80[.]exe | Triage

Sharing

General

Target

NEAS.638c870c29122cb27e0038203e3edd80.exe
Size

119KB
MD5

638c870c29122cb27e0038203e3edd80
SHA1

488ea42396c80ac87270ea69b8de540f3e195469
SHA256

f9399bcd99481119c0096591e6c2c5a6dad2f16f57c630eaebf57f2493643c3a
SHA512

697c07ac5479d119ebff685fa1c575d3ab68b8046c06b633aad861dde5b7c36b3c06aae670de02c3295c0e6be894224191e6165c6333a6c43a08b171fa1e7ca4
SSDEEP

3072:OzHD2XMHBxHtu7o3VS9UQ8act2cMg9OERFNtrO7Y:Oz6RRi8ct2/EDrqY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.638c870c29122cb27e0038203e3edd80.exe

Files

NEAS.638c870c29122cb27e0038203e3edd80.exe
.exe windows:4 windows x86

63955b2eaf72ee031ec09fca691dfc0b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStdHandle
MoveFileTransactedA
IsWow64GuestMachineSupported
Wow64GetThreadSelectorEntry
GetAppContainerAce
FreeConsole
K32EnumPageFilesW
GetFirmwareEnvironmentVariableW
SetLocalTime
K32GetProcessImageFileNameA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE