NEAS[.]129fc78abb20ce550efbffb8b130b920[.]exe | Triage

Sharing

General

Target

NEAS.129fc78abb20ce550efbffb8b130b920.exe
Size

56KB
MD5

129fc78abb20ce550efbffb8b130b920
SHA1

79e8f5f2d252413e29931740131f386e50e466ee
SHA256

e1b855493352c93931066b1d9a5663031dd60a4b12a38273267d4e1ea1244baf
SHA512

1361b286596c79cbe99faacf4564657feeb3f177d9269cd803ca4bf3782afe6e6b85fee1b96e82e6db940a42a61c6c97e177e8e71fd5f02bfcd52103b54c1ccf
SSDEEP

1536:dqD9LY2IS1hozmiJppmBwgyudz12kZJ2oDOF:dIDIJppOwgyut/XK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.129fc78abb20ce550efbffb8b130b920.exe

Files

NEAS.129fc78abb20ce550efbffb8b130b920.exe
.exe windows:4 windows x86

5b7b73ed3e8df94cbe342d53fd395d99

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Module32Next
CreateMailslotA
GlobalFindAtomA
DeviceIoControl
SetSystemTimeAdjustment
FormatMessageW
ReadConsoleInputExW
InterlockedFlushSList
GetCurrencyFormatW
SwitchToFiber
DeleteVolumeMountPointA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE