NEAS[.]86f8a18f167d88a52833afc8bdcf6250[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.86f8a18f167d88a52833afc8bdcf6250.exe
Size

119KB
MD5

86f8a18f167d88a52833afc8bdcf6250
SHA1

df1869033420ea23874e83aa1911960fcf1aabe1
SHA256

e5544384d0ffa18961cde05ccb75c2ccb9b4768300992f0ba07d8010898ad546
SHA512

c9f769e0f73349448dae148448b5cd26eb829220868fd787708b8136be407ee1ed596147aa30fe5046396f56eefe2bd86b955726f4783ffbffaa9a1888e124c2
SSDEEP

3072:0cjd15h2hg8BjbDXzRjAa4e2TP9yDFmDlIC9jRLIsEgFh:001+BHzMRioZ9jNIByh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.86f8a18f167d88a52833afc8bdcf6250.exe

Files

NEAS.86f8a18f167d88a52833afc8bdcf6250.exe
.exe windows:4 windows x86

30f5ecbd9739ddc43a35356fa3606594

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Wow64EnableWow64FsRedirection
K32GetDeviceDriverBaseNameW
OpenMutexW
DeleteBoundaryDescriptor
GetFirmwareEnvironmentVariableA
BaseIsAppcompatInfrastructureDisabledWorker
CreateProcessAsUserW
MapViewOfFileExNuma

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE