NEAS[.]6c7799a50a27f60c03aadbbd3f6cf040[.]exe | Triage

Sharing

General

Target

NEAS.6c7799a50a27f60c03aadbbd3f6cf040.exe
Size

119KB
MD5

6c7799a50a27f60c03aadbbd3f6cf040
SHA1

d8cabd6620a2d859a6b538b5d172b584c75002d9
SHA256

c255421d59dcf2ad485dc6cdcc9e1dc873ad2796c0cbecafe5e5e80d54b90a17
SHA512

26824d2afbd290f128bba1ea6b8da1af98b4ac412816be3e8c332a52dc7331fddb17e9d60bc1b2e26168dc99ef77fa514396b36d813937c3d5ff130a522cc35f
SSDEEP

3072:3afdGaLBQFQpUHb4Qxm2W7EUghMrB7/H0wTSTwH+9:3EtLCFQpY4XLnF7Hrej9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.6c7799a50a27f60c03aadbbd3f6cf040.exe

Files

NEAS.6c7799a50a27f60c03aadbbd3f6cf040.exe
.exe windows:4 windows x86

1f79b3f0d9a88f954bbae69bcc012e91

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

UnmapViewOfFile
WriteProfileSectionA
GetFileInformationByHandle
LocateXStateFeature
ReadThreadProfilingData
WerpNotifyLoadStringResourceWorker
GetLongPathNameA
GetActiveProcessorCount
SetComputerNameA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE