NEAS[.]f8bf92fbd3f81f45125a0731049d1d00[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.f8bf92fbd3f81f45125a0731049d1d00.exe
Size

119KB
MD5

f8bf92fbd3f81f45125a0731049d1d00
SHA1

2922f7527591767dc245e65bc2be95d90aedf37d
SHA256

d9d16b233a21f643dcddbb2e2cdabe24c0ef815627621a8a44c2666c507189cb
SHA512

379ca1a7049c3e01212b2726a79d2d4fcd70d0085871d1c8a5cfcb26e0b2db26c6765d6bb9a2f5961c372cc969cc5b40b66b91c0c226fc1540bfc6580bd3dd91
SSDEEP

3072:Jk+W1Sq9/ra4ptB0HdiKp+s2vaLL09ZlwrJ:zq97ahVLADSJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.f8bf92fbd3f81f45125a0731049d1d00.exe

Files

NEAS.f8bf92fbd3f81f45125a0731049d1d00.exe
.exe windows:4 windows x86 arch:x86

64c96b47a05e143180931f95305fd46b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryW
SetThreadSelectedCpuSets
CheckElevationEnabled
AllocConsole
QueueUserWorkItem
LoadResource
CreateWaitableTimerA
lstrcat
TermsrvCreateRegEntry
AreFileApisANSI
PrivMoveFileIdentityW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE