NEAS[.]1e1765b58b9e5d99f0ec68ac664e5190[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.1e1765b58b9e5d99f0ec68ac664e5190.exe
Size

119KB
MD5

1e1765b58b9e5d99f0ec68ac664e5190
SHA1

3232302e4500f50a09a7947624aa1a2d14555085
SHA256

3e2c056eac8968e6e6bd3f585e75c542c490918cdb79ca20dcc694ff867cf0b5
SHA512

5a5860d9201852166a0b6df67c67fb5960223ee9dda46c43c968bf1ba4706f9332451efc63da3d28ac9c5d8ecec8486a4ef660dea21f09743feb4393bbbdb9a7
SSDEEP

3072:zZaK5n222pBv609BBK/xtuBjUVwr8MVo6yvUIAMH0rDm70y:NaKeji09XK/TYT8MVUvU9M8Dm7N

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.1e1765b58b9e5d99f0ec68ac664e5190.exe

Files

NEAS.1e1765b58b9e5d99f0ec68ac664e5190.exe
.exe windows:4 windows x86

10d7a554796bb24188fa71152b391025

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RegGetValueW
FindFirstVolumeMountPointW
GetCurrentPackageFullName
GetTapeStatus
GetComputerNameA
LCIDToLocaleName
GetApplicationRecoveryCallbackWorker
WakeAllConditionVariable
WerUnregisterRuntimeExceptionModuleWorker

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE