NEAS[.]06448bc05f9be4dc45b9550f70d466c0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.06448bc05f9be4dc45b9550f70d466c0.exe
Size

924KB
MD5

06448bc05f9be4dc45b9550f70d466c0
SHA1

aa091115064dacc8e50db244ba9912b57a80a2bb
SHA256

440289cd5bd329095ad20bf856f727b239f0ee72b2ef96a8f564a0d86f00a9bb
SHA512

70ba6f535ee03d108123123d7ea89b69cf60db9b6d182cc82fc74e86e450f9068a195f3f5b7ab101f430df699fa92e5cbedd6a53c63ad3fbcbaed5187de44c93
SSDEEP

24576:jmDiQ5YkQGOjOYnTkaj+W4daMT4uOuyl4v:0inROYF9pMlv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.06448bc05f9be4dc45b9550f70d466c0.exe

Files

NEAS.06448bc05f9be4dc45b9550f70d466c0.exe
.exe windows:4 windows x86

e23dbaf1b1aeac5c3032987a2f7cb752

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

HPALETTE_UserSize

ntdll

NtAccessCheckAndAuditAlarm
NtReadFile

kernel32

GetCurrentThreadId
GetCurrentProcessId

Sections

.text
Size: 917KB - Virtual size: 920KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 329B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE