NEAS[.]48d5950c1ccaca8e21800bdc3e0899d0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.48d5950c1ccaca8e21800bdc3e0899d0.exe
Size

119KB
MD5

48d5950c1ccaca8e21800bdc3e0899d0
SHA1

708a5c85624823c4581bd658a371b1221479b408
SHA256

9d9bc9139fadb0cef188f6ae9e5c4981fddb0a2b6b878f30ad379c0ce64e3477
SHA512

3bc64e079774cc2b90e06ff3321d4112f7c774a70757cc3ba19f05c4a92a0582486ee1a7dc7de0378cb1eb90af36c4d36f4bfc7c19c8b94dc7b145375aae773d
SSDEEP

3072:bKLwdaAcdQSHWyaSe/ePlkqyhCEpUkJZfU:ba2S2P/ePlWcEpUcBU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.48d5950c1ccaca8e21800bdc3e0899d0.exe

Files

NEAS.48d5950c1ccaca8e21800bdc3e0899d0.exe
.exe windows:4 windows x86

3beb9f31bd54ac4fabc043b465622d77

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetMaximumProcessorCount
GetProcessIoCounters
LocalFileTimeToFileTime
GetActiveProcessorCount
GetCommandLineA
RemoveVectoredContinueHandler
EnumerateLocalComputerNamesA
IsBadCodePtr
PackageIdFromFullName

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE