NEAS[.]c954d2dcc3b42c5e754bc6766c744cb0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.c954d2dcc3b42c5e754bc6766c744cb0.exe
Size

119KB
MD5

c954d2dcc3b42c5e754bc6766c744cb0
SHA1

cfd1f85035a9663b0fdb77deca6073dea0a20442
SHA256

bf4a2a719ff844bd14e129919bb4fdd47730585077fb6496d1f88acce0aedd63
SHA512

b48b9a0d4d79d08ee4c2e957204a713149020b420b956043c1e8c40e6e65ddc5c4a51da52999fc24fab0570811469585dade97dc6be04e83fcf3c1c194407cbf
SSDEEP

3072:nH7ALZBv2E3pbgPjQpjWl9OifW95tnsbDUEwBti2TVcTtFE:Hs1YE1gPjKWl9PY7sTw+2TVcTtO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.c954d2dcc3b42c5e754bc6766c744cb0.exe

Files

NEAS.c954d2dcc3b42c5e754bc6766c744cb0.exe
.exe windows:4 windows x86

f58f47503d4e725bc8562ad9a5394240

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetDefaultCommConfigA
Wow64RevertWow64FsRedirection
CreateRemoteThreadEx
WerRegisterFileWorker
FlsFree
ResetWriteWatch
ScrollConsoleScreenBufferW
BuildCommDCBW
CreateSemaphoreW
GetCurrentPackageFullName

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE