NEAS[.]1a7d6c3a80d4db1078e26c5a87136e60[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.1a7d6c3a80d4db1078e26c5a87136e60.exe
Size

119KB
MD5

1a7d6c3a80d4db1078e26c5a87136e60
SHA1

6ec846809cc2c860ba074f387945bb0a72879cad
SHA256

9a081c87a5ae03b6d10d658aa58afb332d833113ff4edfcbdf241de1875518f3
SHA512

52d63112f2b8301a33fb0c7dfb56b361fecde2d294d65c89d620027b47029e750030c8ad4599d6a69208599a3ec522e41ef8f28a7dc889d96240f46e287cd1f6
SSDEEP

3072:J5TBDJ0N4OsOb3P4gGALmUFaT5/4yz24kNt0ox5l3l:Jl70NBPJGlUgt/4yzhohxl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.1a7d6c3a80d4db1078e26c5a87136e60.exe

Files

NEAS.1a7d6c3a80d4db1078e26c5a87136e60.exe
.exe windows:4 windows x86

2b824b480b3b771e0eb354bc83d3de71

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

QueryActCtxSettingsW
CheckAllowDecryptedRemoteDestinationPolicy
UTUnRegister
LeaveCriticalSectionWhenCallbackReturns
WriteConsoleOutputCharacterA
QueryThreadCycleTime
GetModuleHandleExW
GetCurrentPackageId

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE