NEAS[.]028b25f1f0a537977493d76f32a80570[.]exe | Triage

Sharing

General

Target

NEAS.028b25f1f0a537977493d76f32a80570.exe
Size

722KB
MD5

028b25f1f0a537977493d76f32a80570
SHA1

a442c83bbc521d8d77671ab83fd0edeab710c115
SHA256

6ea019b1198f52147a2871899c9571f75057c2de6b86dd374f4c297a977dab2f
SHA512

4cfca4044d1cb37cbb91ed72490b615ef3514bb52db48ea20d451bcc6aefba9c50b6a476e5e2bde1b6bac64633444dbcf3f4da1a1877733b38a1e526f88bea85
SSDEEP

12288:GihV27JbZVpni7HSufIGzdl/3PaSQsCrX7KaURM5o4UV8Sq9HM++p9qy9u:uNZjnijBIcx35QZ7Oy5oN+9OEyU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.028b25f1f0a537977493d76f32a80570.exe

Files

NEAS.028b25f1f0a537977493d76f32a80570.exe
.exe windows:4 windows x86

17b867f82ae17d541d84a3de0143eee7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

ZwQuerySymbolicLinkObject
RtlWalkHeap

user32

GetKBCodePage
EnableScrollBar

kernel32

GetCommandLineA
GlobalUnWire

shell32

SHStartNetConnectionDialogW

Sections

.text
Size: 713KB - Virtual size: 716KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE