NEAS[.]14c7fea3de69d1728b3f8112f230c210[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.14c7fea3de69d1728b3f8112f230c210.exe
Size

119KB
MD5

14c7fea3de69d1728b3f8112f230c210
SHA1

3d87326d830bd0a801f29a7d53f1d85085207f01
SHA256

3f6e1e024029261c9ebddc7c34948e9bb53f4608918127f96800cb36ea8ce291
SHA512

6bf938e6350e4e013ae5864b0d7ac9219de6caebe50912c7d4d5c7771dc309c9678ee102e1fd5141a5c6b2b275eac466f3c85e742eb63de4fe399b832934110f
SSDEEP

3072:Cw5CVhJRr3xF/KHORnPUvPIArVYdNYGBlek6Pwd1piMx3sRV:CsCX1F/46xApaCClek6PqPiMC/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.14c7fea3de69d1728b3f8112f230c210.exe

Files

NEAS.14c7fea3de69d1728b3f8112f230c210.exe
.exe windows:4 windows x86

a4264ac3e69d3f331897730535a33deb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

BackupWrite
GetProcessDefaultCpuSets
FindVolumeClose
SetThreadErrorMode
SignalObjectAndWait
WritePrivateProfileStructA
FindFirstFileTransactedW
GetFileAttributesExA
RegFlushKey
BaseFormatObjectAttributes

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE