NEAS[.]f48509d966b644eaa06a78a1b3129520[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.f48509d966b644eaa06a78a1b3129520.exe
Size

119KB
MD5

f48509d966b644eaa06a78a1b3129520
SHA1

06ec440a54493d678ac8376b15ad923b7ddd492c
SHA256

401573457d6f34d2cae81c672cb4623c11f3685a558037f7164a19d780a79921
SHA512

8fcd11e8b5962d9f0f35bb0b99e37b3a2e58f15d89ac8d8f61a2697af646d9a2a916c05e821b3b67cbbb6340b006aeef4a70c7bb956f8f49c6bb7389f4f63cc4
SSDEEP

3072:IQilEtEQf/AJIcuWxuITQUqgw6vnSYSbt1mLqCa+gwBfgw:IQi4f/AvxbQUqjbtVCa+Lyw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.f48509d966b644eaa06a78a1b3129520.exe

Files

NEAS.f48509d966b644eaa06a78a1b3129520.exe
.exe windows:4 windows x86

80ad62ea459186b6bd87e6de1a562526

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LZInit
GetProcessGroupAffinity
InitOnceExecuteOnce
GetEnvironmentVariableA
GetCurrentPackageFamilyName
SuspendThread
ReadConsoleA
CreateDirectoryW
QueryIdleProcessorCycleTimeEx
TermsrvDeleteValue

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE