NEAS[.]1c8bbeb566b04c57d9b162007bde2a50[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.1c8bbeb566b04c57d9b162007bde2a50.exe
Size

119KB
MD5

1c8bbeb566b04c57d9b162007bde2a50
SHA1

d7186ad80e80235b861ab256ab12b07bd8c450b4
SHA256

eaff03fa9aee967b48ddd9eb4053a4d7edbbbf5cf14044055a281eead0a2a592
SHA512

5cf53633ad1f0e3677b4137c514ade0a3de8084bd54b772ff8078b49c64a896e5fad905d8045447ce423d54cd670a0d42ef857f38978525402b9fc7ef64ead71
SSDEEP

1536:wekhlmz8Ix7/be7QT21qjSL2gqDfvmuc5/9KYbBhWpAjMggdgeeObwFV9MpX:RkhlKhT2o0W2ucT9HWpCKleObwFVipX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.1c8bbeb566b04c57d9b162007bde2a50.exe

Files

NEAS.1c8bbeb566b04c57d9b162007bde2a50.exe
.exe windows:4 windows x86

77ea1b577bb7d8a2839fc46e6db482e1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileW
QueryIoRateControlInformationJobObject
OpenJobObjectW
FindCloseChangeNotification
CreateHardLinkTransactedW
ReadConsoleOutputA
BasepCheckWebBladeHashes
GetDriveTypeA
CancelDeviceWakeupRequest

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE