NEAS[.]526a0437688d85dd42d2e696b31667a0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.526a0437688d85dd42d2e696b31667a0.exe
Size

119KB
MD5

526a0437688d85dd42d2e696b31667a0
SHA1

e1b77feba628fb0b16045eb7b52915fbcbdb5997
SHA256

a511b5e649b4b5518e668e515dd04ef55c98b5ea3412705d3d061b445bfec007
SHA512

e07605927c6b51da5b172c840d47a6e2c9d3724e4ec0975ddb14d5b83422ac3fc7eae0df99071d0c1012939b3f2696dca088b8c2913fa7e17d0b2ff3c4a79d09
SSDEEP

3072:jibsKAcCIvo4kD2XDOvlsh4acqMXVcW6/X:jXcE4KuDgCcn+WwX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.526a0437688d85dd42d2e696b31667a0.exe

Files

NEAS.526a0437688d85dd42d2e696b31667a0.exe
.exe windows:4 windows x86

7d0d2e4d21bdf806e44fd0518c0362ab

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalAlloc
WriteProcessMemory
CreateEventExW
InitializeSynchronizationBarrier
SetThreadpoolStackInformation
EncodeSystemPointer
ConvertThreadToFiber
FindActCtxSectionStringW
RegLoadMUIStringW
MoveFileTransactedA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE