NEAS[.]cdca9d8a894866128b92b5d2c8aea080[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.cdca9d8a894866128b92b5d2c8aea080.exe
Size

119KB
MD5

cdca9d8a894866128b92b5d2c8aea080
SHA1

816ac0dbe8d950a33152b4089ec249d1b8e6b978
SHA256

84bb9fc8d147e827ff3c298bf119f4eb57c7c168803eb2eb26e6be1dc44830e9
SHA512

5f78a04b657e82506fa3e14af95f7f1e51792ef6874d670b9ed4e9a0e87931303797c85f3eb5b39953abc603d24e5f1c14e3a816feb5c2767807ca22f6aa2041
SSDEEP

3072:9Yg3F89wPGcPLiCR+Q1N/iEXLxP+bzTf2ZCPX2s:9YGJPRLiCR9N6EXLxcbTXb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.cdca9d8a894866128b92b5d2c8aea080.exe

Files

NEAS.cdca9d8a894866128b92b5d2c8aea080.exe
.exe windows:4 windows x86

58e9d35ba704dd04fa2ea5d4036b971f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFirmwareEnvironmentVariableA
SetVolumeLabelW
GetProcessWorkingSetSize
SetLocaleInfoA
TlsSetValue
GetProcessVersion
ReadConsoleInputA
CopyContext
lstrcmpiW
DebugActiveProcess
EscapeCommFunction

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE