NEAS[.]6979540bdd15e472e33df26383c86680[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.6979540bdd15e472e33df26383c86680.exe
Size

119KB
MD5

6979540bdd15e472e33df26383c86680
SHA1

6a5aa4c3f66f395e81be97e44f5de196570bbb56
SHA256

0e3eb528b2591b48cec82daa2f2ccfdc1ffaf9a7672a90e4dc060551f925e200
SHA512

a06bafaa6bc11b027e14368908cc78f442bd556e941c1daf46e7e3c2c03406c7d2554998424944a3c08c73ed5b2d31f2cb66134c17cf55bfdf9a72e79428470d
SSDEEP

3072:AvCNfcC6OjvR0GZeAKgSqG03okizTmtemSd:zNfcNOt7ZXfJKTmtem2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.6979540bdd15e472e33df26383c86680.exe

Files

NEAS.6979540bdd15e472e33df26383c86680.exe
.exe windows:4 windows x86

808545ea3d389d5cf1f24efcdc58e001

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateSymbolicLinkTransactedA
GetCurrentPackagePath
IdnToNameprepUnicode
GetLongPathNameTransactedW
PackageNameAndPublisherIdFromFamilyName
CreatePrivateNamespaceW
SystemTimeToTzSpecificLocalTimeEx
AddLocalAlternateComputerNameW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE