NEAS[.]561cb3ec04cbcc3c6aaaa7dbdc799900[.]exe | Triage

Sharing

General

Target

NEAS.561cb3ec04cbcc3c6aaaa7dbdc799900.exe
Size

119KB
MD5

561cb3ec04cbcc3c6aaaa7dbdc799900
SHA1

daf1559f894e9791f176fdfeb4fab074d60ae0aa
SHA256

47185550f4e5ac860476fb565f7393d1df0848cb9e0f5be62129da0b61b306bb
SHA512

d3ac53a629e7a346ef9547e918805d24690f5ef5ed587aa005de72be988b75d0f8c0bfa8726aa27c94404847cf77df172a7e3dcf82a480bda795ec5dfe0a6dab
SSDEEP

1536:j4dPjvbvADNyht440NKCoitmNVG8hfWB0/0SBFS1lH0C1Sx9Qg5BQym06czzjxz:EJb4D24408iYGgW+MSBGUJvjxz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.561cb3ec04cbcc3c6aaaa7dbdc799900.exe

Files

NEAS.561cb3ec04cbcc3c6aaaa7dbdc799900.exe
.exe windows:4 windows x86

f7dc4cac4722d572da20d707c9a8387d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InstallELAMCertificateInfo
WakeConditionVariable
MapUserPhysicalPages
ReadDirectoryChangesExW
GetConsoleCommandHistoryLengthW
SetCurrentDirectoryW
lstrcmpA
K32EnumPageFilesW
FindFirstFileA
LocalUnlock

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE