NEAS[.]38a4f4eaf44842e21473b6afb2b85bf0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.38a4f4eaf44842e21473b6afb2b85bf0.exe
Size

119KB
MD5

38a4f4eaf44842e21473b6afb2b85bf0
SHA1

a2fb7ce091d03155efd4b5bcefbecf227d0e198c
SHA256

945d06cb0adf50aac6b833841febe0e7c58caa4270cf514d39a76e4a0c97f7fc
SHA512

aa0f525cf1bd83cc39adb4d3016376534c9172e338fc86f7dde1b853167724da7d8a64cd922a9f5545fb41153c5c09517d020563cfb325fd943076dbf04d0ece
SSDEEP

3072:yGJM7YOUSEu+/FlRdlKk4vlbx9IpxYCJDOd:5CR+PXlKkCl9IxYC5c

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.38a4f4eaf44842e21473b6afb2b85bf0.exe

Files

NEAS.38a4f4eaf44842e21473b6afb2b85bf0.exe
.exe windows:4 windows x86 arch:x86

6be005accee4b550c9731c0cb85709f4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetUserDefaultGeoName
GetNamedPipeServerProcessId
PssCaptureSnapshot
PrefetchVirtualMemory
CompareStringA
SetConsoleCursorInfo
RegDeleteValueA
SetCachedSigningLevel
CreateBoundaryDescriptorA
CreateNamedPipeA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE