NEAS[.]c860c7a3ac05561c3e75502f1a08b540[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.c860c7a3ac05561c3e75502f1a08b540.exe
Size

119KB
MD5

c860c7a3ac05561c3e75502f1a08b540
SHA1

5390a1675f1860e75bd7316e1b4dc17981044297
SHA256

e142526a63059f8617703d76f73198c72891faa99ae00ed6a9427fdd281999b6
SHA512

d11f2f4e3cff321ee26b5d51dd65e16fc6368e974952c3bf9912cbe2fce38e28e9ed662cc0cd32d2532ccc8935e545bb350e103ad4c50f93f5fb660973818cc1
SSDEEP

3072:nBGW9hCAzpwWWQa/F0fTLlM0GaYHvvoDP4U6v5PlPSWxuv8lJVx:BGShCAzeOaN4LlMNHnoMUCPlPyKJVx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.c860c7a3ac05561c3e75502f1a08b540.exe

Files

NEAS.c860c7a3ac05561c3e75502f1a08b540.exe
.exe windows:4 windows x86 arch:x86

97ef0562679988305e5525d5095a7765

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
SetConsoleIcon
OpenThread
GetEnabledXStateFeatures
_lwrite
K32EnumDeviceDrivers
WerUnregisterMemoryBlockWorker
VirtualAllocExNuma
WTSGetActiveConsoleSessionId
FreeEnvironmentStringsW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE