NEAS[.]b4d3d24198b4546d428a2d9160d54cd0[.]exe | Triage

Sharing

General

Target

NEAS.b4d3d24198b4546d428a2d9160d54cd0.exe
Size

119KB
MD5

b4d3d24198b4546d428a2d9160d54cd0
SHA1

431322c47c5f4a220b8abdd06f1a29fda8b14898
SHA256

2ee2bc00b13d3bdd36a63af336c48089cec0f4118cc904e828cd10d3ecaabe27
SHA512

3b4864f2b726bb38a930df634583fae56b2fd02472c39f77462a7769005db0d9c226f5ce58ab806916656f77796432315ab7dcb94ad7e27b2510282a40aaeeca
SSDEEP

3072:sLoOYgbtGaKZ/8GTm9TNuDhwitn051qkmt:UDBiyBudwlyt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.b4d3d24198b4546d428a2d9160d54cd0.exe

Files

NEAS.b4d3d24198b4546d428a2d9160d54cd0.exe
.exe windows:4 windows x86 arch:x86

c2fa2bdb8e80e7c27f3818bd9135deb3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RegCloseKey
ReadConsoleA
VDMOperationStarted
ClosePrivateNamespace
BaseWriteErrorElevationRequiredEvent
ActivateActCtx
FindVolumeClose
RegisterBadMemoryNotification
FindNextVolumeA
WerRegisterFile

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE