NEAS[.]e68a43209df9301b988258eb9aff90b0[.]exe | Triage

Sharing

General

Target

NEAS.e68a43209df9301b988258eb9aff90b0.exe
Size

119KB
MD5

e68a43209df9301b988258eb9aff90b0
SHA1

21927fdfac050d1d4252d553894c0c22250018f4
SHA256

4b424f6352f5d97b7135c611295a4f3df8adf6ce8967273bc2e5e9dd0888e068
SHA512

5dcdbef541fca400158e435d1639bd229d56d1a1d3226636efcef365d77e0002f80ff2b083490297e02c9f681be2358a14307dd0e502091ae101f15824b369e7
SSDEEP

3072:ICbxzCZQ1HRkHTyTR/OhVMsCQfplOVhUcWWmaa6:/bxziQ1HRk6gVMsffplOUp6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.e68a43209df9301b988258eb9aff90b0.exe

Files

NEAS.e68a43209df9301b988258eb9aff90b0.exe
.exe windows:4 windows x86 arch:x86

5ee34c86e1bef27d43c4295ade1c4766

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

EndUpdateResourceA
lstrcmpi
OpenConsoleWStub
SetFileApisToOEM
OpenFileById
UTRegister
CreateProcessInternalW
GetCommState
FlushFileBuffers
ReadConsoleInputW
CreateFiberEx
OpenJobObjectW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE