NEAS[.]6531b7c24efaa8d86e80c03975cafa40[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.6531b7c24efaa8d86e80c03975cafa40.exe
Size

119KB
MD5

6531b7c24efaa8d86e80c03975cafa40
SHA1

1346820c2e9fb80956b1d08b7cdafc610bab1cae
SHA256

bd62cc374a768bc1d3e575916f5f431967122cf6c39847cba6d9028835cf8b73
SHA512

29f8fd33fa76215ec690a65ae75818266df19e70e05190d779d1f93c03a13b822b874fd9f6ec00e317218a19aecdb4d636fa2426aaf6a91dd449f5df153eba04
SSDEEP

3072:gns5PWmR9RyBsLEmt7xcZFi1RPtJeAfTZkBXizWRx:gGKalcXeVo5yzY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.6531b7c24efaa8d86e80c03975cafa40.exe

Files

NEAS.6531b7c24efaa8d86e80c03975cafa40.exe
.exe windows:4 windows x86

a9d12f70bf8954709d58bb02d2523a34

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RtlMoveMemory
GetFileSizeEx
lstrcmpi
RegDeleteTreeA
K32GetProcessMemoryInfo
DecodeSystemPointer
FindNextVolumeMountPointA
DeleteTimerQueue
SetPriorityClass
IsCalendarLeapYear
SetFilePointerEx

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE