NEAS[.]0770892ba102a143b7e61265f648c400[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.0770892ba102a143b7e61265f648c400.exe
Size

119KB
MD5

0770892ba102a143b7e61265f648c400
SHA1

7720b32448dacefe25a98aaa51fc93d4c74e1a1a
SHA256

7e37896a5c8cf478f23f93ea6e636d3fc4bf42b27d8c0f477dfc426bf4337a0b
SHA512

01fe8121d5fda610adbee7615df47f8acd966810585f31b59352a6eeec6ca4cd293308fb4bbdc7cc006375ac5147bc1624ac252136abeb9807857775980a87b0
SSDEEP

3072:zajD5CIOhwCXJaGWs4PuA5zX/sFiWjwDDuh67ts8aJwh29WIG:zwCBhXXsGETkcWjODuWtZgW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.0770892ba102a143b7e61265f648c400.exe

Files

NEAS.0770892ba102a143b7e61265f648c400.exe
.exe windows:4 windows x86 arch:x86

895f03f0b34b183501f120b371b18245

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LCMapStringEx
SizeofResource
InitializeSRWLock
CheckElevation
CreateSocketHandle
GetThreadUILanguage
GetProcessWorkingSetSizeEx
WriteProcessMemory
GetUserDefaultLocaleName
SetFirmwareEnvironmentVariableExW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE