NEAS[.]11b94b6a13b5a592073e05b303db05e0[.]exe | Triage

Sharing

General

Target

NEAS.11b94b6a13b5a592073e05b303db05e0.exe
Size

119KB
MD5

11b94b6a13b5a592073e05b303db05e0
SHA1

6bc78c3aef9f3dfa21c14c15e9276d41fead27d0
SHA256

d249a2442ff2c0c9d66333c55bf7bbb338c28da3478a623e59c4c938d3b7d27d
SHA512

6fa793bc3d89603e755d5d374dfdc00520510318ca1c1ef2566f918cad6f2893294000d137a1c2e564a2df104cdaa23836310bb0e5a58e19e7a647e87b83cba4
SSDEEP

3072:K7vbVkdT8dVsyDtYI5eekbe5eRwIx2NfIZl:4RITiq2Y9ekbe5Rs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.11b94b6a13b5a592073e05b303db05e0.exe

Files

NEAS.11b94b6a13b5a592073e05b303db05e0.exe
.exe windows:4 windows x86

779d409a31e255858126b6b02d59b9c8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetPrivateProfileSectionW
ExpungeConsoleCommandHistoryA
SetFilePointer
GetThreadPriorityBoost
GetPrivateProfileSectionNamesW
CreateDirectoryExA
BaseGenerateAppCompatData
OpenPrivateNamespaceA
SetFileApisToOEM

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE