NEAS[.]4ce0d06edfef52d410e4eb9b814e3220[.]exe | Triage

Sharing

General

Target

NEAS.4ce0d06edfef52d410e4eb9b814e3220.exe
Size

119KB
MD5

4ce0d06edfef52d410e4eb9b814e3220
SHA1

04adabf5c513bea0c8eb309f6addd21c8aac0dfd
SHA256

4a11342dafeb18ccbae3e03bae21371f2ad359447685d5687c27befefef28110
SHA512

7e3852aac06ac424c36af2adaecdab3f65da570edd9b0291a115441874768b5b9cbc50750ccfcf25dc984b7be84f0025b86feed18e6edfbafca622656c879bd3
SSDEEP

3072:aEFyfYAEfA1bS7RzxLQ5N0WFLgC84z5qPcGe:a8SYAZ1bWxM5NRZg14z58cN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.4ce0d06edfef52d410e4eb9b814e3220.exe

Files

NEAS.4ce0d06edfef52d410e4eb9b814e3220.exe
.exe windows:4 windows x86 arch:x86

e5ca014553a24af23724bd7bed3d2272

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteCriticalSection
SetTermsrvAppInstallMode
GetCalendarSupportedDateRange
BasepPostSuccessAppXExtension
Wow64EnableWow64FsRedirection
FindPackagesByPackageFamily
CreateRemoteThreadEx
CreateFiber
WerRegisterRuntimeExceptionModuleWorker

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE