NEAS[.]0af59c6148cec9ee49c8acd505d8a3b0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.0af59c6148cec9ee49c8acd505d8a3b0.exe
Size

119KB
MD5

0af59c6148cec9ee49c8acd505d8a3b0
SHA1

2aced1e031e5030f24fc483d98f559f7fb37ed86
SHA256

490a331c50f60397505053625d6ef270a2a95c3dcbc0bc54373a702cfebc2cd2
SHA512

fd2f936f35f27a184664356e292372930122a0b57317323fff19a60f2248f93c490063b737dc0d8f6de210c5c58b8d01e60a68b1d09304ea57338bdf3bfe6764
SSDEEP

3072:qM/aVYNbz4YdsPgob7rT3LyYx9fXOSr9W18SEvgM2y3Yo:qM/IYi+27rrhOA+nyf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.0af59c6148cec9ee49c8acd505d8a3b0.exe

Files

NEAS.0af59c6148cec9ee49c8acd505d8a3b0.exe
.exe windows:4 windows x86

9706843cdcac8ac229f24060b07f4336

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualQuery
GetPackagePathByFullName
ClosePackageInfo
DeleteFileTransactedA
TerminateThread
GetSystemTime
BaseUpdateAppcompatCache
FindNextVolumeMountPointA
OutputDebugStringW
K32EnumProcesses

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE