NEAS[.]46435461181a4b69f0469165ebf86aa0[.]exe | Triage

Sharing

General

Target

NEAS.46435461181a4b69f0469165ebf86aa0.exe
Size

119KB
MD5

46435461181a4b69f0469165ebf86aa0
SHA1

cea199612b174fe6bf3b5840e4fb83999ff52c5e
SHA256

be56d6c2e6abb48e48884229fc6de2a821a412410930423e7263fd78448e68ff
SHA512

9e703a01bd860be45b1a91deee88212457bad3649dfc40db60078429dc0bfb1c2bed5ce5ac0621966c691bb045e43dbfd95c15a75744500145af6a43c71b6817
SSDEEP

3072:PFj0WdhiR+u+f9cQObXsM0FK1b4JTT90TJV/nGuhX4wv+/PE:PF1Di+6BbXsM0c1bgOJBnGuxiE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.46435461181a4b69f0469165ebf86aa0.exe

Files

NEAS.46435461181a4b69f0469165ebf86aa0.exe
.exe windows:4 windows x86

6b668fb8611758ef56ce9a23efe30e28

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WerUnregisterAppLocalDump
CreateThreadpoolWork
ReleaseActCtx
RegGetValueW
SetProcessDefaultCpuSets
GetNextVDMCommand
EnumDateFormatsW
SetComPlusPackageInstallStatus
WerRegisterMemoryBlock
GetSystemCpuSetInformation

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE