NEAS[.]6fb6154af8f689967525bee52df66000[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.6fb6154af8f689967525bee52df66000.exe
Size

119KB
MD5

6fb6154af8f689967525bee52df66000
SHA1

aba3aa1e71128d94809536023cb5d52dc09dcb13
SHA256

4d595440f6ec92a6c1fef2db044581077e6ed9d3a2f272da012de7fb5cb818cb
SHA512

014f42ec9e0683ac9fe5188cab8fa67cdce581fbf809f30e4d34b8e647359e5f73eaacfbdced190f115dc1bdb2cb95b03fa7fe2b66d4e5c9cc5722c2e309cc09
SSDEEP

3072:srs6xlY2+YR+F5KhRKLS5SMs/qzRzgxKiDqVaD+C+eLkiiW:dulR+YR+F5QRKu5E8RYxRLkiiW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.6fb6154af8f689967525bee52df66000.exe

Files

NEAS.6fb6154af8f689967525bee52df66000.exe
.exe windows:4 windows x86

f9e8697ebf8e396f5eca735fcec0e722

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FlushProcessWriteBuffers
TlsGetValue
WerpNotifyLoadStringResourceWorker
CreateHardLinkTransactedW
SetCommMask
DeactivateActCtx
LocaleNameToLCID
GetFirmwareEnvironmentVariableExW
GetCommTimeouts
FreeLibraryAndExitThread

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE