NEAS[.]f493fdb363f6f2c1079de01df8bd7c80[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.f493fdb363f6f2c1079de01df8bd7c80.exe
Size

119KB
MD5

f493fdb363f6f2c1079de01df8bd7c80
SHA1

b1dde0887d76cdcf01bed471dfbc7acb0b05d77a
SHA256

6fab3f3c1d0f5457fb8994989c1b99587cbf6598a6f42474b90a00605aae4ce4
SHA512

c87eee29398eba85768a6159cdfa36f60e1cc2fbc75392cdc4839c210a09a27e590dc4fda22e26b81bb7ce04961efc0ebc818cbd8d8031a58190635bd167f0a2
SSDEEP

3072:mBwPYLcAsUV4j2eEg1H8NrrEtKpsFWcH4Lr:OwALrV4KeEgh8tEzFvHW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.f493fdb363f6f2c1079de01df8bd7c80.exe

Files

NEAS.f493fdb363f6f2c1079de01df8bd7c80.exe
.exe windows:4 windows x86

ae174fda5581aee335dc720a7fd5510e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrencyFormatEx
QueryUnbiasedInterruptTime
GetNamedPipeHandleStateA
GlobalAddAtomExA
GetNumaAvailableMemoryNodeEx
BasepAppContainerEnvironmentExtension
LoadAppInitDlls
EnumDateFormatsW
InterlockedCompareExchange

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE