NEAS[.]63c6f2207a2507ee1e468ef4a81a0d30[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.63c6f2207a2507ee1e468ef4a81a0d30.exe
Size

119KB
MD5

63c6f2207a2507ee1e468ef4a81a0d30
SHA1

144f5493b6595fa2410bc260bec9dad1527bbac4
SHA256

e5b902c84387c598ebf37c3a793f0a0b4c896132e43b36447dda3728916abfb9
SHA512

47406e9371c9c52478a1d6678369892d0b4982fcba15529f2b3ea8e5f415d2e2e1c62901d188afd8ec0c0d69c35ce9bea516d271632a6b56f04c4a0faecc6e4c
SSDEEP

3072:+IUfno5/cf2aNv00RdHK5QB/w7n0hHRL4t:ygmBFdqVLQL4t

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.63c6f2207a2507ee1e468ef4a81a0d30.exe

Files

NEAS.63c6f2207a2507ee1e468ef4a81a0d30.exe
.exe windows:4 windows x86

edac35faaa2a793167f67958b440c10d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetThreadPriority
GetCurrentPackageId
ReclaimVirtualMemory
EnumResourceNamesW
QuirkIsEnabledForPackage4Worker
GetShortPathNameW
GetCompressedFileSizeTransactedA
RemoveDirectoryTransactedW
CreateHardLinkTransactedW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE