NEAS[.]d3b034b254ded1d9f666c69d57f3fd70[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.d3b034b254ded1d9f666c69d57f3fd70.exe
Size

119KB
MD5

d3b034b254ded1d9f666c69d57f3fd70
SHA1

1aca2df72faaee5996d95c00f6b359e60b8a8984
SHA256

7b7d42224883a824a2f069373a8272d05f8ac9932413d2400e3bd98ee273372a
SHA512

7981d69e08717239328390b31285787f638e8cc0f166b6a34bf99006520c7dc0e66069d037d545c807d64c42e089f75396d94016c4f4b0a7e277c2b928f0c096
SSDEEP

3072:9Fm3MIdDLO8MB8Ai0TRBFg0TnqxDwvQ/yRmRaZ+t2RyviiiDu:9U8uDirZi0T7FgJDx/tE+t2yviZC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.d3b034b254ded1d9f666c69d57f3fd70.exe

Files

NEAS.d3b034b254ded1d9f666c69d57f3fd70.exe
.exe windows:4 windows x86 arch:x86

c3b1ae1045e486d6a5fe89c38039ed50

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStartupInfoW
OfferVirtualMemory
GetWindowsDirectoryA
GetConsoleInputWaitHandle
VirtualQuery
SetProtectedPolicy
CeipIsOptedIn
WerUnregisterMemoryBlock
DebugActiveProcessStop
FindNextFileA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE