NEAS[.]63feeded6a4d2d52994471983a38d210[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.63feeded6a4d2d52994471983a38d210.exe
Size

119KB
MD5

63feeded6a4d2d52994471983a38d210
SHA1

e6eb915cc29ea0fa3ec8aadec163fb76a00a9bcb
SHA256

1fadbfb770466d9b13938238067d5b63fa88c1bbfda53c76ac66df64ee2379b3
SHA512

696490a610280fbe6613e28412985c72e75bc4d3b465acd1399d98e641d9fa3d451b9feb9938017c34dfce9f24f08e1d1a529bb46aca3ba51b123082cbb01110
SSDEEP

1536:WlyhfgbTkau/CUJlkXqHsj+8zK8IsBOwoGWc+CezfvP3UcjxcJmIBMSYcX629iJ:WAqT2/vzA6sjRKkbN+7z3vUmxgmGS2O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.63feeded6a4d2d52994471983a38d210.exe

Files

NEAS.63feeded6a4d2d52994471983a38d210.exe
.exe windows:4 windows x86 arch:x86

525695e1f182fabb3e969780aef02726

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

AddLocalAlternateComputerNameW
IsWow64Process2
FillConsoleOutputAttribute
CreateSemaphoreA
SetThreadpoolWait
SetThreadLocale
DebugActiveProcess
CloseThreadpool
FindFirstChangeNotificationW
GetCurrencyFormatA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE