NEAS[.]985957e8804a6edd2c5977a093f98970[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.985957e8804a6edd2c5977a093f98970.exe
Size

119KB
MD5

985957e8804a6edd2c5977a093f98970
SHA1

74ba7e96eaf5a7c5b715433b7b83409e7fe5bbba
SHA256

9f07eec8da7b1c64d50c3d2529e272a244e2186a212db93b6693ced0bb911bf4
SHA512

b893313e0590fa365e0411bc647a342ba1a1ca3a826f7e41b62b12a1a3cf2eeb93bc0b662a09ca17911db08c22b5c1999c7d32d80edc6591f05d0341d5fc1dcc
SSDEEP

3072:dsoFN7RPE39bVmWhefuCDPtYUQKrWCLY5AGTuxb:WomFJeGCzKtGvLY5AGkb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.985957e8804a6edd2c5977a093f98970.exe

Files

NEAS.985957e8804a6edd2c5977a093f98970.exe
.exe windows:4 windows x86

22ab10429631fa6d1322b264c168d395

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

PrivCopyFileExW
GetSystemAppDataKey
OpenJobObjectA
Wow64Transition
BaseUpdateAppcompatCache
QueryIdleProcessorCycleTime
WerpLaunchAeDebug
RequestDeviceWakeup
GetCurrentProcessorNumberEx
GetThreadTimes

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE