NEAS[.]bb2eb81ac62ad72811a7bf725a6d6160[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.bb2eb81ac62ad72811a7bf725a6d6160.exe
Size

119KB
MD5

bb2eb81ac62ad72811a7bf725a6d6160
SHA1

3bdb4c92991e0bc46a63e50a11392c9bd3582d7e
SHA256

e0bb89482b9e2a57808f2a7706bd8595f19bfb1cdfc0954843e2c38ef45aec95
SHA512

c36d78e6427e3f5130f3029bcce8ebfc247077bc1f7dce67f8e3b982559ce13fd51f2adfb6a4c3ebdf067722ec8f135e63a43237e88261d29b265f246974fc27
SSDEEP

3072:TSONH4PCnZCbyS2iT7HoozKJqo5bPgsZFmDTNFHXzNQC:WOaWy2OtfebPgsZFGzNj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.bb2eb81ac62ad72811a7bf725a6d6160.exe

Files

NEAS.bb2eb81ac62ad72811a7bf725a6d6160.exe
.exe windows:4 windows x86

37d0608de3173062f47e1701a9af030a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetDiskFreeSpaceExW
ReadFileEx
CreateProcessAsUserA
MultiByteToWideChar
_hwrite
GetApplicationRecoveryCallback
ReplaceFileW
GetThreadSelectorEntry
DeleteVolumeMountPointW
ClosePackageInfo
BackupWrite

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE