NEAS[.]c01a1bff5dfadd803dfbb8cd67e32620[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.c01a1bff5dfadd803dfbb8cd67e32620.exe
Size

119KB
MD5

c01a1bff5dfadd803dfbb8cd67e32620
SHA1

9c1741f7ebb7a7689bb48a6088145b8e7986bc1b
SHA256

1a4cfdc4d76452c2b5060f6ad0b144f55091b5eaddc45feab385a47ccbca6790
SHA512

dd59ed97aa8a6bbb498079c0264910661853433d26f3cc21ed29fc7a22c395ad6e4b3a497af4bc5764c9adbc07d5a1d2160157c7fa91240e1e7a3c5318e005a2
SSDEEP

3072:la81jpwzWyqfshjCXYaAmfeR+s6sT8WKos83+gJmPyLHzQ:E8jpwzb0SAY5mfqJHTVf1+6zzQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.c01a1bff5dfadd803dfbb8cd67e32620.exe

Files

NEAS.c01a1bff5dfadd803dfbb8cd67e32620.exe
.exe windows:4 windows x86

651dc9b22bf7374ae78b6fedde363ed1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateThreadpoolWait
CopyFile2
FindFirstFileNameTransactedW
CloseThreadpoolWait
ConvertThreadToFiber
WerGetFlags
QuirkIsEnabledWorker
ReadConsoleW
GetLogicalDrives
CopyFile2
RemoveSecureMemoryCacheCallback

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE