NEAS[.]48f0a4d10ee5d64c6764a61c19b29a60[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.48f0a4d10ee5d64c6764a61c19b29a60.exe
Size

119KB
MD5

48f0a4d10ee5d64c6764a61c19b29a60
SHA1

9bbf401f6e7ede881e08b9548a5c22a3da658c6f
SHA256

e258f9b8a8847bc67fe6c61f7fecf19fd98124c734fc62032f80e93414ffe42b
SHA512

164b3aebd92bd42f70e9b1b450210cf9a2be051b47e4c627cce859aec97d1897ae4db5f4ee54e3094975b77f83dbdae6309d3142cf99720d43f1229227ba822e
SSDEEP

3072:cRADe0tW+c/Y/vs58/Q3E01amNJmbb/dgz:aA7tWx/Y/v0f1XHmXU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.48f0a4d10ee5d64c6764a61c19b29a60.exe

Files

NEAS.48f0a4d10ee5d64c6764a61c19b29a60.exe
.exe windows:4 windows x86

20f1b96819b4b806547a5efd3014453f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

K32EnumPageFilesW
RtlCaptureStackBackTrace
TlsAlloc
GetOverlappedResult
GetNumberOfConsoleMouseButtons
LocalUnlock
SetThreadIdealProcessorEx
CreateSymbolicLinkTransactedA
Thread32First
VirtualProtect

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE