NEAS[.]cab032a3e65066d3cf10c06028441ee0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.cab032a3e65066d3cf10c06028441ee0.exe
Size

119KB
MD5

cab032a3e65066d3cf10c06028441ee0
SHA1

300843699d1bf3f5664bf00a352a157dffbd8d18
SHA256

357639e9fcc0b983d3ae69438a6c9268cfa10257858e797c8cda8ea49bf181f2
SHA512

d3132b0fa987fe2b31bc5e4ddc939783088c4a6c5b5e23852aa631bcf271f56a523bc0d84e933e7fc9a583e388b212595343a802487fe714b062d44e6f56af04
SSDEEP

3072:uTdR7ZWRV5iMcZ6N2u42QaeRG3e1M0a1draZawe:uTdwj762MG3YSdrai

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.cab032a3e65066d3cf10c06028441ee0.exe

Files

NEAS.cab032a3e65066d3cf10c06028441ee0.exe
.exe windows:4 windows x86 arch:x86

cf3cb1cac4b75ee2641c0980d9f0fce2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetPhysicallyInstalledSystemMemory
IsWow64Process
DebugSetProcessKillOnExit
FreeLibraryAndExitThread
CompareStringOrdinal
SortGetHandle
EnumSystemFirmwareTables
GetModuleHandleExA
GetFileSizeEx
CreatePrivateNamespaceW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE