NEAS[.]81576219bb58c71b0a40e4159518d4a0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.81576219bb58c71b0a40e4159518d4a0.exe
Size

119KB
MD5

81576219bb58c71b0a40e4159518d4a0
SHA1

55dd7d49d24f3e1a1e50c68ab3b8b6950df7d9f1
SHA256

9e80c4580adcd6494742408ede95dac6553da92d7bd03f107d9513d0f8e496f4
SHA512

feca663c307d575b544f387401113e95779ab95d84a422bd5a58b9596afd56bc717ffc059cf7552884202e86563909ec4c38ba98857ea2218c92e8204b610ece
SSDEEP

3072:Vz0zlK3QdbwK20MwSIyElxWTg47wP/ayWWPazk6umDKIP:mzlK32bs09HyEbWTg4C/ZWWPSucKU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.81576219bb58c71b0a40e4159518d4a0.exe

Files

NEAS.81576219bb58c71b0a40e4159518d4a0.exe
.exe windows:4 windows x86 arch:x86

c7b225f421416736e5dfe9cf3689b29b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LZCreateFileW
GetPackagePathByFullName
GetComputerNameW
lstrlen
CreateThreadpool
TermsrvRestoreKey
EnumResourceLanguagesW
WerRegisterFile
LCMapStringEx
GetDefaultCommConfigW
GlobalAlloc

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE