NEAS[.]26e7229b20610e4165f9d09547bd7670[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.26e7229b20610e4165f9d09547bd7670.exe
Size

119KB
MD5

26e7229b20610e4165f9d09547bd7670
SHA1

340752fa586694a47c141caa77428b7e35313c5c
SHA256

5f9843f9c59803e7f1b7e294ca366767436ece821cbe8a5efa17224a0bf4162e
SHA512

83587144197034ec12ff968feb3e30005857bff70d16cb8e881457f685e3558141921095dc90b8f7223b4175e03bab8c0724c7f9d860012dca1cab85bb1f3c28
SSDEEP

3072:H1lMRJ+NoMPwi+wAPIbJZY6rbMl99Jw5kVq9+JxLjND:Hv7CMovJQbJZFIbPQkM+V

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.26e7229b20610e4165f9d09547bd7670.exe

Files

NEAS.26e7229b20610e4165f9d09547bd7670.exe
.exe windows:4 windows x86

9c605abd32094f4848062a36a12104c3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

K32GetModuleFileNameExW
BaseQueryModuleData
GetConsoleCommandHistoryLengthA
WaitForSingleObjectEx
BaseInitAppcompatCacheSupportWorker
Module32NextW
IsBadWritePtr
SetThreadpoolWait
_hread
OutputDebugStringA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE