NEAS[.]1e93a9a7e3233c848bad3ba2302ea4d0[.]exe | Triage

Sharing

General

Target

NEAS.1e93a9a7e3233c848bad3ba2302ea4d0.exe
Size

119KB
MD5

1e93a9a7e3233c848bad3ba2302ea4d0
SHA1

91ae424dfa8acfc9383045e58ced334ff17f9fba
SHA256

e8eeca8109036a722a093234c31c44b9dfc0a6b1994fe8c8d75ed57b4337ee70
SHA512

6b591fd598c9a6f8c49203a6800507b8e88cc8735a456faffbd492174c32b43e44c837e3e02d2486ee7cfb584b95000fa2fd0b9e93bfe892ddf8d68c13ec08a0
SSDEEP

3072:Nf+oJ9V0zVt28t15Bestwr9U0bnK8kfoj+JSxBlVycT:WEOBe/pLKpSxBmK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.1e93a9a7e3233c848bad3ba2302ea4d0.exe

Files

NEAS.1e93a9a7e3233c848bad3ba2302ea4d0.exe
.exe windows:4 windows x86 arch:x86

da79aede6d303957be7325915be40cc4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Wow64Transition
FreeUserPhysicalPages
NtVdm64CreateProcessInternalW
WritePrivateProfileStringA
ClearCommBreak
PackageNameAndPublisherIdFromFamilyName
AppPolicyGetProcessTerminationMethod
FindResourceA
ReadConsoleOutputW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE