NEAS[.]019617024c67ffc8c87dc6d73ee7bee0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.019617024c67ffc8c87dc6d73ee7bee0.exe
Size

119KB
MD5

019617024c67ffc8c87dc6d73ee7bee0
SHA1

7c5c9971d81701e43c0b8e19bc26d9884c208716
SHA256

e48c063441500f04baf75cf290359871addac03dfbd43a90d7477d010c887375
SHA512

a9b8cf452adc521344f715f4082e14b20261e07848d1f0a70f6e3995c5f25dfca5d4c124aff5e69cdbfa71480cd3b66961d13d05669fcb897fc2fd26a1364518
SSDEEP

3072:8BZ++T9sGk15AsGZdUGTVfwGItCRe2hFjwWcj9Qs/UNDPW:K++pYBMqiVfwzUg2yjas/WzW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.019617024c67ffc8c87dc6d73ee7bee0.exe

Files

NEAS.019617024c67ffc8c87dc6d73ee7bee0.exe
.exe windows:4 windows x86

934ce59c83f45f604889a101bae9cc57

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CheckForReadOnlyResource
GetGeoInfoEx
UTUnRegister
GetConsoleAliasW
WritePrivateProfileSectionA
Wow64EnableWow64FsRedirection
DeactivateActCtx
CloseThreadpoolCleanupGroupMembers
QuirkIsEnabled2Worker

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE