NEAS[.]84d6c085a8284d80d42de81fce1b7540[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.84d6c085a8284d80d42de81fce1b7540.exe
Size

119KB
MD5

84d6c085a8284d80d42de81fce1b7540
SHA1

e82e717819c7545a9176f320415407a47761e40e
SHA256

64749977cab143f414e44d20fe6b7430f4ef2549fccb6ad6b42a8e5d68701c17
SHA512

556d8300daf14346577d46f7112bd4d432d43496afbe86f67089a8379e289ccc86314ee664629e6e82cfce39dacbe763471f35d75b9592e14c83d09aadb05d1e
SSDEEP

3072:3DCTL19btIOHucuOHoHGpYmD8F0Yvy0Gn+DSxQH6:3Da19bJucuxHnmDgNvG+DEQa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.84d6c085a8284d80d42de81fce1b7540.exe

Files

NEAS.84d6c085a8284d80d42de81fce1b7540.exe
.exe windows:4 windows x86 arch:x86

e162f8db39fb1465258af2f35ee8f878

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SleepEx
RegisterWowBaseHandlers
DeleteAtom
GetLongPathNameW
CreateJobObjectW
VirtualAllocEx
GetFullPathNameW
GetThreadId
lstrcpy
GetThreadPriorityBoost
GetStartupInfoW
ExpandEnvironmentStringsA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE