NEAS[.]1bbf51a27887d197de67e5b5b0537540[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.1bbf51a27887d197de67e5b5b0537540.exe
Size

119KB
MD5

1bbf51a27887d197de67e5b5b0537540
SHA1

a671cd91910e1e6afe5bc5f7ee618bea2b927ca8
SHA256

486705dd1d8284ddfa30cea45c30061fa8f05b6d79fb7324c2d9ff78ba67f550
SHA512

c7326ac9b5f8541623d8bcba96027339e4c11e683e5489ca0a2a266665126ac22c8587dac7e2827de0fe1366be22c9d1066baf3d2d315e5cf4fbf311bb4b2130
SSDEEP

3072:jfmDqgbT+mhn/YV6tHtkBxVoI5V/YfJxt6oCGAh10L:jgx3+8HwHpBYRxtEs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.1bbf51a27887d197de67e5b5b0537540.exe

Files

NEAS.1bbf51a27887d197de67e5b5b0537540.exe
.exe windows:4 windows x86

08aacbec63220d962e8eb5464de37118

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualQueryEx
SetEventWhenCallbackReturns
FindNextVolumeA
FatalAppExitA
SleepConditionVariableCS
CloseThreadpoolWait
GetCalendarDateFormatEx
InterlockedCompareExchange64
CreateBoundaryDescriptorW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE