NEAS[.]5fd0ce5d1ea8d149829c901d6368fb70[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.5fd0ce5d1ea8d149829c901d6368fb70.exe
Size

119KB
MD5

5fd0ce5d1ea8d149829c901d6368fb70
SHA1

b226db4301e372d5eec35718f791465ba659a658
SHA256

055a1ea3157835b78e9849df4c7abd010d2fe9a59760111b86606ad6e5058445
SHA512

53cc2be2be305bdde69fc220a704a8ebcbe03c9670af754dd693f383957c481bd03b147a3d9166454f2208ec8185210ea46271642c8c66c9e95442d236eab320
SSDEEP

3072:/CeyBE+sGyKxwn12qn9GchV+m6QvenI0HPbz:KNBEluG9HVcvrPX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.5fd0ce5d1ea8d149829c901d6368fb70.exe

Files

NEAS.5fd0ce5d1ea8d149829c901d6368fb70.exe
.exe windows:4 windows x86

36e4bef11079794f0b9a768a8656f74d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OOBEComplete
WerUnregisterAppLocalDump
LZSeek
GetCalendarWeekNumber
GetCurrentProcessorNumberEx
Wow64DisableWow64FsRedirection
HeapSize
GetConsoleHardwareState
QuirkIsEnabledForPackage3Worker
EnumSystemGeoID

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE