NEAS[.]54fab8d49042c96f7ab5c7f767580c10[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.54fab8d49042c96f7ab5c7f767580c10.exe
Size

119KB
MD5

54fab8d49042c96f7ab5c7f767580c10
SHA1

419f2116a95b3a6083fb3a12d3064192a9229c5f
SHA256

8529d89be245012c03bc82b18286855e5c92d34c32b43f7f542dc3db5afea5cb
SHA512

6ba123bf6ddde4052a1d20dccd19330eadc165a4432b3dbe154daf6453938c074d9d39df77481bbae364af4c842d427f880538957f8203633d32265bc6aa9c87
SSDEEP

3072:T7P7r3CcFGDNkDeniXfOZEG2aUQjZ5yPRvaz6+VOa:njzCBDXn2VbaUQmRSz6y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.54fab8d49042c96f7ab5c7f767580c10.exe

Files

NEAS.54fab8d49042c96f7ab5c7f767580c10.exe
.exe windows:4 windows x86 arch:x86

f511431a8545fb17d5f08526894b5a43

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RegNotifyChangeKeyValue
BasepCheckWinSaferRestrictions
GetActiveProcessorGroupCount
SetSearchPathMode
DeleteAtom
TlsAlloc
RegisterWowExec
QuirkIsEnabledForPackage4Worker
FindFirstChangeNotificationW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE