NEAS[.]e859b9a81d593cfb70ccac1edc039570[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.e859b9a81d593cfb70ccac1edc039570.exe
Size

119KB
MD5

e859b9a81d593cfb70ccac1edc039570
SHA1

833be3b6365c3b9c9cb3fb49fe4f8bf2d8d05f43
SHA256

68b08a7fa9a727e4c84203d9b4894e57e8a050dbc2d07647a91155a68a474745
SHA512

9bbef99c15c79ce965521fc83c2c5778cc8466dcfa6665363f968ea9458a6b22dd272f30497cf02a06cad7302cd771e60a4eb54f6119555769b4a0038b490171
SSDEEP

3072:K3VDzoTJHBZ7cpkHiDb7Ke5nnYqPlonC5eAbO5pNb6kR:KzehZ7wjD6e5xQixbeNLR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.e859b9a81d593cfb70ccac1edc039570.exe

Files

NEAS.e859b9a81d593cfb70ccac1edc039570.exe
.exe windows:4 windows x86

d01b0df8058b3a5df6e682bc3c28f027

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetNamedPipeInfo
FlushFileBuffers
EraseTape
QueueUserWorkItem
GetExpandedNameA
CreateRemoteThreadEx
GetCompressedFileSizeTransactedW
LocalHandle
QuirkIsEnabledForPackageWorker
CloseState
GetConsoleOriginalTitleW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE