NEAS[.]e469458ba3b8f4c1e91dd693b4b7e3d0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.e469458ba3b8f4c1e91dd693b4b7e3d0.exe
Size

119KB
MD5

e469458ba3b8f4c1e91dd693b4b7e3d0
SHA1

7e1d525c0ee6a9c19c2c68a792713cb007f53041
SHA256

937cefdc051478af549d36cd3441703ef012865abf454fd7e850e8daf3f38a2a
SHA512

c67aca9d48b724e8fde2ae4ab2bc8fac8be1dc824398a7fc002d30c65f91f11400ec1ddefc31b8e3ef2a811319a11aed540e7dce6421c08158a24ed5ff073a83
SSDEEP

3072:nZpRS2cOqYeQf40jGwiV+WRDC7JCQfVLb0YZfNk4:7RS2cOqYlGlVeSYZy4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.e469458ba3b8f4c1e91dd693b4b7e3d0.exe

Files

NEAS.e469458ba3b8f4c1e91dd693b4b7e3d0.exe
.exe windows:4 windows x86

68c5795e70774eb4db1be3d20272ca31

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualQuery
QuirkIsEnabledForPackage3Worker
GetDefaultCommConfigW
QueryPerformanceCounter
GetProcessAffinityMask
FreeEnvironmentStringsW
FindResourceW
GetConsoleCommandHistoryLengthA
InitOnceInitialize

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE