NEAS[.]1bf1cff722ca19b30ca7a329c9edd690[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.1bf1cff722ca19b30ca7a329c9edd690.exe
Size

119KB
MD5

1bf1cff722ca19b30ca7a329c9edd690
SHA1

7de56033520d702d440ce1ecd6ba33ed4a102973
SHA256

31b7230d329f1c528244588164f0e67bd7918c99488dbf34b092bcd6b3b6f0cd
SHA512

4b25ef6e56d71b6136407046a501be97dd6606a085cbdbae8ea83e01210b95b4b0f413ee091fa34dbee4e5a828d5090ad372d377808efd057c0adfb7e56bbf54
SSDEEP

3072:4KtKrJDX667+wmOgzo3S2y4RhQDe2NEeRd5EgK+jK3GmF:dtKrJrTiwmOhPy4oni+di

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.1bf1cff722ca19b30ca7a329c9edd690.exe

Files

NEAS.1bf1cff722ca19b30ca7a329c9edd690.exe
.exe windows:4 windows x86

625b40939c3407120a7bbeb7bbcadcdc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateEventExW
GetCurrentPackageId
GetProcessWorkingSetSizeEx
GetTempPathW
GetExitCodeProcess
CloseThreadpoolCleanupGroupMembers
GetPackageFamilyName
GlobalFindAtomA
GetGeoInfoEx
QuirkGetDataWorker

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE