NEAS[.]2e6f3424105a5699d6b69e86a6782290[.]exe | Triage

Sharing

General

Target

NEAS.2e6f3424105a5699d6b69e86a6782290.exe
Size

119KB
MD5

2e6f3424105a5699d6b69e86a6782290
SHA1

09344902636175f62fdc73d3fb64493fef1ccaea
SHA256

5b413b963fb5064ce85f64a57f0ff96d5ed03240061ea14a536fe8792e571f48
SHA512

239752e4e190b14a1e252773845322f15ba7e2f5bd1ed668cd6b47d13bf3c79e2bae373246036f1c2fe0b2d7be87fd1054fa5162db07e59bbe0b03d33fdcc353
SSDEEP

3072:CDfRSzk0jh3loYFEo/WqYe7XaOPhozNWjZVR/rg75PqEJGKkT9PtX48:CDfRlSloBYWqYe7XmzNWjHZSqQGJltXH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.2e6f3424105a5699d6b69e86a6782290.exe

Files

NEAS.2e6f3424105a5699d6b69e86a6782290.exe
.exe windows:4 windows x86

370ae3224314b1b02d737fd1c49064b2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalFileTimeToFileTime
GetLogicalDrives
WideCharToMultiByte
GetApplicationUserModelId
UnmapViewOfFileEx
FlsGetValue
InterlockedCompareExchange64
GlobalAddAtomA
BaseDumpAppcompatCacheWorker
GetCompressedFileSizeW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE