NEAS[.]1063b72e94734306ca7302a519763d70[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.1063b72e94734306ca7302a519763d70.exe
Size

119KB
MD5

1063b72e94734306ca7302a519763d70
SHA1

3abc61fc63e3201be81e5b230008b768296762f9
SHA256

06344412a5327914ea6877f2b41c95998ae8d810d09bc65718d0e8c6574a837a
SHA512

d6fb06d1a3ca2593d60a3ba300560cbfcf9a7039e191421901090aa08bc929700411eb8dfbe086f3021d1098cde828ef970b961897c75663ba014ad63ec4d674
SSDEEP

3072:NTxjbtUtLMnXBcEzZXHfVL1Qnz6DJ9gW5IDSYVZA6fN3w8:NXbGIhzQnU93IDzZvR1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.1063b72e94734306ca7302a519763d70.exe

Files

NEAS.1063b72e94734306ca7302a519763d70.exe
.exe windows:4 windows x86 arch:x86

e942aa2395675f20149746e1e8bf3851

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetMailslotInfo
AreFileApisANSI
WriteFileEx
RegSetValueExW
AddAtomA
PrivMoveFileIdentityW
GetCommModemStatus
GetCurrentDirectoryW
GetVDMCurrentDirectories
WriteConsoleOutputAttribute
FoldStringW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE