NEAS[.]80d4120ff8370398a5e35742b778c820[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.80d4120ff8370398a5e35742b778c820.exe
Size

119KB
MD5

80d4120ff8370398a5e35742b778c820
SHA1

45d51d1582747205c8c75d97e4cf3ed7b8977a46
SHA256

10a6d19e002e616b0856bc3040796b1b9ba4095ab171f60da910b387d9668263
SHA512

27df6c2dfe4c6fa8cf0d127516b81ca98a923cef63d9c6868c20fb4f2315cd304fa5f5cbae26a2696bda433078fe942f1aae5d7f4b756a994590e42369126eb7
SSDEEP

3072:TajBNR6dMhWGjo6S3nyRcQhfHEcujVmRvMvb:+ziMx/U0cgfHEcDkvb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.80d4120ff8370398a5e35742b778c820.exe

Files

NEAS.80d4120ff8370398a5e35742b778c820.exe
.exe windows:4 windows x86

f85ea4efa633428beac95e65bafd1ab6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

EnumUILanguagesA
GetProcessPriorityBoost
GetCommConfig
GetLogicalDriveStringsW
AddRefActCtx
SetStdHandle
LZCloseFile
PulseEvent
OpenWaitableTimerA
GetProcessId
IsProcessInJob
GetProfileIntA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE