NEAS[.]9c2187ecc4f09bc4cad19cf16847af00[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.9c2187ecc4f09bc4cad19cf16847af00.exe
Size

119KB
MD5

9c2187ecc4f09bc4cad19cf16847af00
SHA1

037d3bfafa7822ef0bf2e8b78a304dd8165e548b
SHA256

6cdebff4657195ab8caed6e1a9b6040e3b2b5b5be29104f5a7f35d2339726225
SHA512

38bf462a6bc851dbfd089417d9b6d3bf6ac8ee9716e6fc7349ae2dd4a56e0d606179fb8bb2bd7e7df9a1ce92271369e6bcfcf2ec1adbedafb786f04595fc6a8e
SSDEEP

3072:m/kHaCq8nU3GCFo6KLW2Ol7WbWPKEasf+TIRqvSsRy/QOKqy:m+U3BoPiyECpQ/QN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.9c2187ecc4f09bc4cad19cf16847af00.exe

Files

NEAS.9c2187ecc4f09bc4cad19cf16847af00.exe
.exe windows:4 windows x86

170576c1fc986abeb7c0013e2d0c4a4b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetPriorityClass
SetDefaultCommConfigA
CloseState
TryAcquireSRWLockExclusive
ReadConsoleInputW
DeviceIoControl
DeactivateActCtx
QueueUserAPC
GetLogicalProcessorInformation
SetEndOfFile
Wow64RevertWow64FsRedirection

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE