NEAS[.]7ff96d6e16c2d21b64c8febd113a0f20[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.7ff96d6e16c2d21b64c8febd113a0f20.exe
Size

119KB
MD5

7ff96d6e16c2d21b64c8febd113a0f20
SHA1

937d3f02ef3de70fef9449d64d86c80d1b995a76
SHA256

aa1d030a7ca5aace51defd58db318453acd564c65cdfb8a214dc5d3619bd2165
SHA512

5ff4a1e4b28b525adfb25acb1274a979dee22685f76174d2f2eceacc65b3c8140f5a10768c96454c49c00fba850d40cd60a07997b086d5a38593b7676be0d789
SSDEEP

3072:u9Hrj1zQOA8RODsq9J99ATXfaC+voNSMBzFzFR956HgHL+Q:OHptBRY9WD3UIPzFBR9AH9Q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.7ff96d6e16c2d21b64c8febd113a0f20.exe

Files

NEAS.7ff96d6e16c2d21b64c8febd113a0f20.exe
.exe windows:4 windows x86

9af565f96672f74013b22f0097b5bf1e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RegFlushKey
GetShortPathNameW
MoveFileTransactedW
NeedCurrentDirectoryForExePathA
NormalizeString
GetExitCodeProcess
CreateRemoteThread
SetConsoleKeyShortcuts
CreateFileMappingNumaW
GetThreadUILanguage

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE