NEAS[.]ac0ad92bb21d99769dda9c537a7a8210[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.ac0ad92bb21d99769dda9c537a7a8210.exe
Size

119KB
MD5

ac0ad92bb21d99769dda9c537a7a8210
SHA1

5f74fc59d237d809e2e63bbacc322cee2e3dae1c
SHA256

bfbec78810c6c72de118087296c41f048b315bdc7c6a3166cec56d5516e58e9b
SHA512

858c8d39cf4b494d54ee5e5bab231c1f19f14a6ab54a76fe804ca903b5441734c3698864e5da593eca51e00d37083af7dace26acc8c588bc921aceb0ed8cf474
SSDEEP

3072:JRVwlHZZPDXFSzVVHOjVy/BQCZLAJ+15fZ37z:Z2HZBjU3O8BQ1m5fZ37z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.ac0ad92bb21d99769dda9c537a7a8210.exe

Files

NEAS.ac0ad92bb21d99769dda9c537a7a8210.exe
.exe windows:4 windows x86

3bf1444ebe4b8c2953761359898214a7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DosPathToSessionPathW
SetFileAttributesA
CreateMailslotA
FindFirstFileTransactedA
TerminateJobObject
InitializeConditionVariable
LocalUnlock
CancelThreadpoolIo
FlushProcessWriteBuffers
GetNumaNodeNumberFromHandle

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE