NEAS[.]1d8d2fcb8e6302696c530a40f235a9c0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.1d8d2fcb8e6302696c530a40f235a9c0.exe
Size

119KB
MD5

1d8d2fcb8e6302696c530a40f235a9c0
SHA1

980e4418e1c0071c46b8eca012b568cded2d57b0
SHA256

5a4c6fb8bc1d2f08b04fecadce0a26da9b578fca7340a807937439d698fa66bf
SHA512

9d932a9d12a35cebea4efabde53bc46f3a780175fcf3d427953e42d308989617835ff62edefec642c1ab935948500ef68eb9bfb6157945b597beddd8ef4a1960
SSDEEP

3072:lYWt32gOyBhjxQJhAGEfc3Y9nbkAPWhFy7lOcYpx:lJjO6KJhAxfZ9wAPWhUBOcYpx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.1d8d2fcb8e6302696c530a40f235a9c0.exe

Files

NEAS.1d8d2fcb8e6302696c530a40f235a9c0.exe
.exe windows:4 windows x86

b27e0cf4b5a386e7aed975de6513ccd5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

BasepQueryModuleChpeSettings
GetVolumePathNameA
QueryFullProcessImageNameW
GetPackageInfo
EnumTimeFormatsEx
CreateEventA
FreeEnvironmentStringsW
GetModuleFileNameA
IsValidLanguageGroup
GetNumaProcessorNodeEx

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE