NEAS[.]67cfee7c4c872cbd568a5eb751b80ad0[.]exe | Triage

Sharing

General

Target

NEAS.67cfee7c4c872cbd568a5eb751b80ad0.exe
Size

119KB
MD5

67cfee7c4c872cbd568a5eb751b80ad0
SHA1

525fab7af42cf93757e0bd69b411f289b58f773a
SHA256

8568890c611f900aa23e12f0917aa1ffdf012d487062bdb5d1049819147f88f2
SHA512

6fe33f9687727c056ee34413f0bbe8ed3dd9ac675ac14bbd4db957993aeac48972358d8e33d19c4225ad2668337b2bb0bea8cd68af673a039c208fb9f449c430
SSDEEP

3072:XTlIawU5x5s+oCvA8PD/Y8l/ckOunXGYF9v/S+ai7+XDE:XTlRwr+W8L/Llw4FRaXiiTE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.67cfee7c4c872cbd568a5eb751b80ad0.exe

Files

NEAS.67cfee7c4c872cbd568a5eb751b80ad0.exe
.exe windows:4 windows x86

ae357fe688e8c887eeb0daa5a17aa2ff

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

QueueUserWorkItem
QuirkIsEnabledWorker
WerUnregisterRuntimeExceptionModule
GetLongPathNameTransactedW
SetCommBreak
PackageFamilyNameFromId
UnregisterWaitUntilOOBECompleted
GetTempFileNameA
GetProfileSectionA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE