NEAS[.]59db384170ca9dac6f5579277ebfc840[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.59db384170ca9dac6f5579277ebfc840.exe
Size

119KB
MD5

59db384170ca9dac6f5579277ebfc840
SHA1

a6c72c9904d6963f7373f5b3da8cffd3ff4a4d2c
SHA256

8db189e6cf80e9a897fa57e00a0b0e8540e3da88772dbfd265031a7f23189d8d
SHA512

dbedce807f54af2cbfc31749017a0e3651472276b7089361507a7241d56c9d73da71335bf4a36d56a0fc719314d583d406f4661e300d9380e0afd7d522523860
SSDEEP

3072:xq6fmUluTPUeQwOGXYxAw3zbyqXJReYZDZyu:Ssub1XYxPjWqX7z5ZX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.59db384170ca9dac6f5579277ebfc840.exe

Files

NEAS.59db384170ca9dac6f5579277ebfc840.exe
.exe windows:4 windows x86 arch:x86

0e15e0750fb2b78378a044f6401ea475

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FlsSetValue
WaitForMultipleObjectsEx
GetProcessId
GetNamedPipeClientComputerNameW
GetTapeStatus
UnregisterApplicationRecoveryCallback
SleepEx
GetFileMUIInfo
FindFirstVolumeW
GetConsoleKeyboardLayoutNameW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE