NEAS[.]681c9c2b697f05b2e12396034788f6e0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.681c9c2b697f05b2e12396034788f6e0.exe
Size

119KB
MD5

681c9c2b697f05b2e12396034788f6e0
SHA1

b80de109bfed5529ec649b2b133c7408b7b168ef
SHA256

43fa9271178d1f8eb4025d1ad777e1a1827187ee2b28df117de63ccc3fc43cb3
SHA512

9caf7a6e8de444d3883ba9cb2ea560286c78819f99617beeb62ff15ca81a25192ceeee577448e6482859750266abad98bbfaffcc7b95150f08c96c3ce9baaea8
SSDEEP

3072:BdcWVgq3ebwn7vVj6IWebmLSSTqKix7EW8p2Tf:v6q17vPWeaLRRKYW8af

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.681c9c2b697f05b2e12396034788f6e0.exe

Files

NEAS.681c9c2b697f05b2e12396034788f6e0.exe
.exe windows:4 windows x86

4ae693113e57c9c4b7f20ca57a4e1f93

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindFirstChangeNotificationA
BasepAppXExtension
_lclose
GetConsoleKeyboardLayoutNameW
BasepReleaseSxsCreateProcessUtilityStruct
SetVolumeLabelW
TlsAlloc
PrefetchVirtualMemory
QueryActCtxSettingsW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE