NEAS[.]e2137b32e61a6224b2b44cc9040d84a0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.e2137b32e61a6224b2b44cc9040d84a0.exe
Size

119KB
MD5

e2137b32e61a6224b2b44cc9040d84a0
SHA1

1cf34b57aa8878ff08d609e350c22b529ff1dc20
SHA256

095451b7032ce3dbe361076c24f32d185b62d17abf4525237c02fac0ab33c295
SHA512

c9e99402efd50a817edf4e988b782dbae6a62fc3771418786741a4f5b6dfe6283f8af1a131f5a7958bcfd9123c2c595583da4c1fcb7f4e10949f0ac095688170
SSDEEP

3072:gYdJVYBhYruom3EMMjYR3FF3w+s0DqbHT9PI8:vY0ruom3EMMMVFFnOu8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.e2137b32e61a6224b2b44cc9040d84a0.exe

Files

NEAS.e2137b32e61a6224b2b44cc9040d84a0.exe
.exe windows:4 windows x86

2e859b7ef1f0e0b94efa442ca4dd3c31

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DefineDosDeviceW
BasepGetComputerNameFromNtPath
RegUnLoadKeyA
PrivMoveFileIdentityW
Wow64EnableWow64FsRedirection
SetConsoleHistoryInfo
GetPriorityClass
DiscardVirtualMemory
CreateSymbolicLinkTransactedA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE