NEAS[.]477b9ea8dee63799bef733ec0673bdf0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.477b9ea8dee63799bef733ec0673bdf0.exe
Size

119KB
MD5

477b9ea8dee63799bef733ec0673bdf0
SHA1

a1aaf25651d80a9b72a1fdd85d927d31abf3b3b2
SHA256

e3af4bc4787230fd509471c22506aa79484a5d0366fd80e196074687eb7611d3
SHA512

f8fa11efeae6bcf4bdce9503929827ac96c686c6fd6e7c5196a12d3e17bb4c713e57b387827c70e8917b76766c4696cf448227bcb7b11d0e40434755e70890c9
SSDEEP

3072:IWqUnd5BG8wIKMmsc18GPTf/Q8LKeEvxn4:IWnbB/KMH+PrQyQxn4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.477b9ea8dee63799bef733ec0673bdf0.exe

Files

NEAS.477b9ea8dee63799bef733ec0673bdf0.exe
.exe windows:4 windows x86

32e8ed4190a7f5f6396ccb96dc4bd1b2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateNamedPipeA
GetConsoleAliasExesLengthW
GetSystemTimes
Toolhelp32ReadProcessMemory
QuirkGetData2Worker
lstrcpy
FindFirstFileNameTransactedW
GetDiskFreeSpaceExW
WritePrivateProfileStructW
WakeAllConditionVariable

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE