NEAS[.]4cb91f073d5c4ea5cc2fe95533ddff20[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.4cb91f073d5c4ea5cc2fe95533ddff20.exe
Size

119KB
MD5

4cb91f073d5c4ea5cc2fe95533ddff20
SHA1

bde4d05bae2aec11d7c7ddf08bddb54bdaefa415
SHA256

53ef09a6e313a6b3a84c625147d6ccea1bcba176878b1666bf039a02261aec6e
SHA512

455763e82979c24e353f2b7028220bf07a1c6c9c9323147c857d7b7c82f4f8d6139b029f5864d928db75bec5476e09a0a8986bd85173c1cea99e02187cd5b411
SSDEEP

3072:eZUpjNiE9871Z/uh3I369H2HvunvdsWD0S2Fm:eOFNiE9mTuh3I+ndYS2Fm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.4cb91f073d5c4ea5cc2fe95533ddff20.exe

Files

NEAS.4cb91f073d5c4ea5cc2fe95533ddff20.exe
.exe windows:4 windows x86

f033987e327212fcc9992010e19e2160

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetLocaleInfoW
GetLocaleInfoEx
ReOpenFile
SetEnvironmentStringsA
CopyFileExA
RegOpenCurrentUser
CtrlRoutine
DeactivateActCtx
CreateProcessAsUserW
GetFirmwareEnvironmentVariableExW
EnumSystemGeoNames

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE