NEAS[.]33afe72b9254b77c60e1b86416d5da80[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.33afe72b9254b77c60e1b86416d5da80.exe
Size

119KB
MD5

33afe72b9254b77c60e1b86416d5da80
SHA1

4c7c9bd7a40bd51280f9d3f9c24e5a79bb6bbc61
SHA256

f542b68c74ab14cbcd9179e88dce15f6da6eec14a770ac7d23086ca771579a1e
SHA512

f803e8469f4f0416e9f7c85099f8c15e9bd07b9069869d22335672f564a3574b77814873f41a1083d83b9b7796997b9211a8301181440404b53fb55adea9e855
SSDEEP

3072:LhiPWYlErhHIdpSnQRMNt3LZVWmXakrq7nA+UdqUP:LkKhHIdpBuPbNqiqUP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.33afe72b9254b77c60e1b86416d5da80.exe

Files

NEAS.33afe72b9254b77c60e1b86416d5da80.exe
.exe windows:4 windows x86

57734004f50de9997cdfd5ba35cf39e6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetNamedPipeClientComputerNameW
AddAtomW
GetVolumeInformationByHandleW
IsWow64Process
GetTempPathW
FormatMessageA
DelayLoadFailureHook
SetThreadpoolTimerEx
GetPackageApplicationIds
CreateSymbolicLinkTransactedW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE