NEAS[.]b0f86015053204a07ea56554e12f6e50[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.b0f86015053204a07ea56554e12f6e50.exe
Size

119KB
MD5

b0f86015053204a07ea56554e12f6e50
SHA1

dcec0e7431eac81b23c95aa88372adabf219e6af
SHA256

b0b458edb56ec243e9ef97aa5a486d0a4c0bc020c915674ffa903f1d430de74c
SHA512

8c9ecbfb3a99e8624e53b807bef9c626f78ea032efc193fc322d5b0d511cb6760c8b2507f7e54dd8cc5f0e2da21557c21930b93cb5e8b8a3570b700091fa4398
SSDEEP

3072:UUjsPQc8Jz95Vfm+0t9+XqRGZhJNcLWy4f39:3mQFz95Vu+g9+XqRGZWWV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.b0f86015053204a07ea56554e12f6e50.exe

Files

NEAS.b0f86015053204a07ea56554e12f6e50.exe
.exe windows:4 windows x86 arch:x86

60ae9126977eb280f74d3e439176caa1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

QuirkGetDataWorker
RemoveDllDirectory
SetInformationJobObject
CreateMutexW
GetConsoleAliasExesLengthW
InitializeCriticalSectionAndSpinCount
GetProcessPriorityBoost
UnregisterApplicationRestart
Wow64DisableWow64FsRedirection

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE