NEAS[.]6f9d39d43fe6b13f0700f121d874cb80_JC[.]exe | Triage

Sharing

General

Target

NEAS.6f9d39d43fe6b13f0700f121d874cb80_JC.exe
Size

119KB
MD5

6f9d39d43fe6b13f0700f121d874cb80
SHA1

96d66e0a12b4b1ed398b04f97f163bc16f89977f
SHA256

6b7033de8e8c3da35eebe6e0c7fe02913a51f867d874cf94ba0fa4888662df70
SHA512

e300c9ed00333092a748b00c2736d8fac81d3b85f4d25683cca78bf31bee1d9020a7896ff3d4362ad28db613c39e439c3147214ec4537b8cbce8288ba79bbf08
SSDEEP

3072:w42sgZ3n+BgEMtO1AS9dkztJyvFWDWP05o:OsgZ3+4tCA8WuRc5o

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.6f9d39d43fe6b13f0700f121d874cb80_JC.exe

Files

NEAS.6f9d39d43fe6b13f0700f121d874cb80_JC.exe
.exe windows:4 windows x86

06ac548ac7d2f1dc9f9dd39bd1210bca

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFirmwareEnvironmentVariableExA
ReadDirectoryChangesW
CreateSemaphoreExA
BaseFormatTimeOut
GetConsoleCommandHistoryA
SetEventWhenCallbackReturns
BasepAppContainerEnvironmentExtension
K32EmptyWorkingSet

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE