NEAS[.]39776668bd55f8cd8acc9b1420344510[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.39776668bd55f8cd8acc9b1420344510.exe
Size

119KB
MD5

39776668bd55f8cd8acc9b1420344510
SHA1

7dee92c0f40c8b69f6de37efc901a86a02779318
SHA256

1f4ca6ed1cf87f8eafd9b58d5ef3cf65363e933737e2f22f9cd00101dce25ec8
SHA512

3859404e8440d3631184f1fa4a53326a39782d1520a157356776202f12df0f7528933bbb139775ea2c244940c7e4c9d11b08488022b7173fd76d126ed68ed3f7
SSDEEP

3072:2i4nbfT2e9rrpMoufZFAh4MRqqUxLbWhnppcINrZQ:wbbZrrC8hEqU9bSpeMre

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.39776668bd55f8cd8acc9b1420344510.exe

Files

NEAS.39776668bd55f8cd8acc9b1420344510.exe
.exe windows:4 windows x86

8fd7ef45d4da1b50b0f8b3f5d81dc71e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapSummary
CompareStringA
WerpInitiateRemoteRecovery
GetQueuedCompletionStatusEx
SetCommBreak
BasepGetAppCompatData
IsDBCSLeadByte
AddSIDToBoundaryDescriptor
WaitForThreadpoolWaitCallbacks
RtlZeroMemory

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE