NEAS[.]5bb295926b1f5d321170a50120bd7e70[.]exe | Triage

Sharing

General

Target

NEAS.5bb295926b1f5d321170a50120bd7e70.exe
Size

119KB
MD5

5bb295926b1f5d321170a50120bd7e70
SHA1

bb86ea34edcdb2fb65a0cb3f3cc7fe2bd407b61a
SHA256

d9f464f8039539b3b4ac4878aa66d61745ceb4799c1230045c8daf8359b1bdbc
SHA512

59f9038570d5020e6a79737b4fb2b82c2d6674a6256d023ac5db7b3197064cad1e93f080deb07f045f49586380e5b9be883eb6f66b7ea2c73dae3c59b06b05a5
SSDEEP

3072:Cwe32a8OTtDuhDtNCSIXt0zse/HXkmhNSVwd42ZfFFRRVbef9I:c3UOTtDENCSId0Qe/3kYHW2F7xeW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.5bb295926b1f5d321170a50120bd7e70.exe

Files

NEAS.5bb295926b1f5d321170a50120bd7e70.exe
.exe windows:4 windows x86

f58d50c453791e0c72df531fc70da99d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

EnumResourceTypesW
GetHandleContext
CloseState
GetFirmwareEnvironmentVariableExA
CreateFileA
GetCommConfig
GetNamedPipeServerProcessId
RemoveDirectoryTransactedW
LoadAppInitDlls
CancelDeviceWakeupRequest

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE