NEAS[.]4a41e23de5078fe866d78bf18966fa60[.]exe | Triage

Sharing

General

Target

NEAS.4a41e23de5078fe866d78bf18966fa60.exe
Size

119KB
MD5

4a41e23de5078fe866d78bf18966fa60
SHA1

8b29fbd055871c921f0c8bd7142675b5492eb786
SHA256

eb272575c4b99585cf5432b76d7296ea556c161532c13e12d16e02f6dbbdf8e6
SHA512

be0393e32c6ebb90c69e8549e662581e2b630ed50dee327dc5c36c0de73a0a8c6d9d959f64441b4f730f8b795dc3124a8033e878fcee01843202b5670b1bb1db
SSDEEP

3072:t85ufT4VEktvU0DGST9NikJ8ayk0j9AXO4dyq2c/wWuf5f:t0iwNdJd50jKO4dD27f9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.4a41e23de5078fe866d78bf18966fa60.exe

Files

NEAS.4a41e23de5078fe866d78bf18966fa60.exe
.exe windows:4 windows x86

4e52805bac24c426a113a3ea0bb9496a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapValidate
SetXStateFeaturesMask
AppPolicyGetLifecycleManagement
LocalFlags
GetNLSVersionEx
RemoveLocalAlternateComputerNameW
TermsrvConvertSysRootToUserDir
GlobalWire
GetActiveProcessorGroupCount

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE