NEAS[.]0ef6de2ee98a41cbd9ee98607d3ba0a0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.0ef6de2ee98a41cbd9ee98607d3ba0a0.exe
Size

119KB
MD5

0ef6de2ee98a41cbd9ee98607d3ba0a0
SHA1

a008a22d8eb9954870db3345192c82907ba0661d
SHA256

14061487e6bad264a4df7b43f82cbe25cf9daf11d7fe93906baaee735183f421
SHA512

a5ec2a7a07ce8b437e73e225011140f6fad240a07d21a42baaf6b98c6cb4aaf8101bb8c6a9e1350a14b2518ef71e91b8551edbbc11f1028b7ea9e08c7a199029
SSDEEP

3072:kYhnE+hrw8HSx0bZjNwc86v89yWYP3MgHtBe:BE2dbZjNDkA8B

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.0ef6de2ee98a41cbd9ee98607d3ba0a0.exe

Files

NEAS.0ef6de2ee98a41cbd9ee98607d3ba0a0.exe
.exe windows:4 windows x86

4c502fba68e9982b3470825e9c8dc36a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

BeginUpdateResourceA
LZCopy
IsProcessCritical
GetGeoInfoA
GetConsoleSelectionInfo
ReadConsoleW
GetCompressedFileSizeW
CreateHardLinkTransactedW
TermsrvSetValueKey
lstrcmpiW
FreeLibrary

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE