NEAS[.]89d20c720710aabe23b5928bd6b8cb70[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.89d20c720710aabe23b5928bd6b8cb70.exe
Size

119KB
MD5

89d20c720710aabe23b5928bd6b8cb70
SHA1

de5e245d30de3c073737440752a637e2232015d4
SHA256

6c291bb2563ec0b912d5a40f6371856573a534b62b6b338e51b052a6284be397
SHA512

3dd60b53a8870c6b26318d034e5b688eed97823a0f962709ab8d78b4b9e3f13870f1cfd4efcd23db8bd1f6a68baa5d5e442ea175c3b4615b18c16100236f883a
SSDEEP

1536:9M+WFiOoejv6wbew9psCwWcFXOb5tOV5g7YbIl46wG2z0mHH2HHGI2y2yMYTffqm:a+GiTOSFebLY5gsdMmn2nGrzyXTXqxQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.89d20c720710aabe23b5928bd6b8cb70.exe

Files

NEAS.89d20c720710aabe23b5928bd6b8cb70.exe
.exe windows:4 windows x86 arch:x86

8694b9299d919fde3dd68cff74aa72cf

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RegEnumKeyExA
WerRegisterFile
HeapSummary
GetConsoleInputExeNameW
SetThreadpoolWait
FindFirstStreamW
LockFile
WerRegisterFileWorker
CreateThreadpool
GetCommandLineW
ZombifyActCtxWorker

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE