NEAS[.]586c4e440d2f094ed61e061ea26b1190[.]exe | Triage

Sharing

General

Target

NEAS.586c4e440d2f094ed61e061ea26b1190.exe
Size

23KB
MD5

586c4e440d2f094ed61e061ea26b1190
SHA1

d2fa547557a11ec0a6bb70e61231beb94679f5a8
SHA256

4ff5851428bd10bffc8d92c09509817bfe0e46028a09d7765379c6f6660629f5
SHA512

1b31eda981e455c265e775a2b92c2c64e7b38464250c7d4e8dc2197da471659aac6708184f50cb9809139fddf94efbd25e18eec577e9c266382f4fe51736a2a9
SSDEEP

384:aHoOO9CC3ZFkV//9QG5qGMX6Lu5y80ztjpb4FYkxBkSU+pONA6eTViC9k:aIOhCpu/FT5QX6Lu5IWFYkPkSHT4F

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.586c4e440d2f094ed61e061ea26b1190.exe

Files

NEAS.586c4e440d2f094ed61e061ea26b1190.exe
.exe windows:5 windows x64

b45408465410e69c955a96d2259342cc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
GetProcAddress
GetModuleHandleW
GetTickCount
GetModuleFileNameW
SetEnvironmentVariableW
OpenProcess
GetLastError
DuplicateHandle
GetCommandLineW
OpenFileMappingW
MapViewOfFile
SetEvent
UnmapViewOfFile
CloseHandle
GetVersionExW
GetSystemInfo
VirtualQuery
GetCommandLineA
CreateFileW
CreateFileMappingW
GetFileSizeEx
VirtualAlloc
VirtualFree
LoadLibraryW
ExitProcess
GetModuleHandleA
RtlAddFunctionTable

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 110B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ