NEAS[.]1396be60076742d0f7dd36dc7cea6db0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.1396be60076742d0f7dd36dc7cea6db0.exe
Size

119KB
MD5

1396be60076742d0f7dd36dc7cea6db0
SHA1

e7e5e91a365dc0869e849c6480cafcdb430f60b5
SHA256

1fd03a2e7537143b222fc85f7f8bee22ace348e6e2d0bd0fde162834e54cdb8c
SHA512

62fbeb27f111329f4410ae3c240fea57acf5cf40c98d9e62272dad8fa361c30b749bc2e6f043830712274ab146193790457860d8611c3b93ad95dcb56d2f317d
SSDEEP

3072:6qocY5QmwjBGMXN3LFGU6IdXzOw9tMKMjYejzS1xFOh+gU:vY5yB1XN3hJOWMjYWS1TO+gU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.1396be60076742d0f7dd36dc7cea6db0.exe

Files

NEAS.1396be60076742d0f7dd36dc7cea6db0.exe
.exe windows:4 windows x86 arch:x86

a0c1e808ea0a45bd050ebd7b9e718c50

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TlsSetValue
PrivCopyFileExW
WerUnregisterRuntimeExceptionModule
GetVolumePathNameW
ZombifyActCtxWorker
GetOverlappedResult
LoadLibraryA
SetConsoleIcon
GetThreadSelectorEntry
TlsSetValue
LZInit

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE