NEAS[.]baab31be634b03f03893cf19e0e7d9b0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.baab31be634b03f03893cf19e0e7d9b0.exe
Size

119KB
MD5

baab31be634b03f03893cf19e0e7d9b0
SHA1

ad9f3a140f91e0c300c6568280f3f54a15535247
SHA256

a208645703f7858833eb54ab7d2613ad3817f427bf3f3d981ce187df90ab2150
SHA512

a3a7ceb10af09eec8f0bcda6eabff3b1d3baf799da633bfa82ef61809b5abd9c7e56a14d9691335bec7af6c87f3e949ba1cc145c25e8e11b69cafaf48b0b39a2
SSDEEP

3072:yGoiwGBOyUiO9MUSmrf+gZyJCG8398IvbZ6:0iwGBUiUSm7+gZBz98O0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.baab31be634b03f03893cf19e0e7d9b0.exe

Files

NEAS.baab31be634b03f03893cf19e0e7d9b0.exe
.exe windows:4 windows x86

f382a16a645453667305daf86c89cedc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WerUnregisterMemoryBlockWorker
WerUnregisterAdditionalProcess
FormatMessageW
FindFirstFileNameTransactedW
InterlockedFlushSList
IsEnclaveTypeSupported
GetPrivateProfileStructA
FindNextVolumeA
BasepCheckAppCompat

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE