NEAS[.]d89bfce2861eb60a7b265038d8111a40[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.d89bfce2861eb60a7b265038d8111a40.exe
Size

119KB
MD5

d89bfce2861eb60a7b265038d8111a40
SHA1

0b5cdd450f12309e614ff33af3d5c4787612008b
SHA256

59772225208664d711f295702f6e3bd8f90f11f4db4e1626ee76a727e9f46f05
SHA512

07d92da1ee587ff72dfd4b3d1474bb9f422fd86087fac17ac0eceb7edc49e15b0973a52dfcc14ef1e96ffb467dc5b56ad544469363eb898cd99399a0d7fbc905
SSDEEP

3072:CJQHCGurvMHt0lk+nbo6juMPkHySLoISjnHVQT+IDldqGeQ+3c:bH+jMHt0i+nbo0RAPSjnWThDldqHQMc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.d89bfce2861eb60a7b265038d8111a40.exe

Files

NEAS.d89bfce2861eb60a7b265038d8111a40.exe
.exe windows:4 windows x86 arch:x86

c54e83e9ca1fa6fe9f13c2c92bcf231f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetNumaNodeProcessorMaskEx
IsNormalizedString
GetCurrencyFormatEx
DuplicateConsoleHandle
GetGeoInfoW
GetLocaleInfoW
K32EnumPageFilesW
RegGetValueA
ReadConsoleOutputW
ApplicationRecoveryInProgress

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE