NEAS[.]b09478127ecab72c53000e3da60fa670[.]exe | Triage

Sharing

General

Target

NEAS.b09478127ecab72c53000e3da60fa670.exe
Size

119KB
MD5

b09478127ecab72c53000e3da60fa670
SHA1

d3df97ceac73697dc0aa5049f989f5bd22b24b90
SHA256

53c951b018b8fd105974ce8c29c14746c0117d12472d79562cad8dc7fb1f7b99
SHA512

134857583e6dd1f21660cfd2f1a9d46c9ba2c1614d383ee9058d533e1d9a43f1d544da5b394cff7b41f15d61f2de820a7f3d69f66965f023d70da8a710358d33
SSDEEP

3072:U4XTDKrARx+JvgJ9epOpdfuERMZRDaoq4byejn3Crn7rSL6H8+Z:bTO/JvweYduERuxaq2y36n66pZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.b09478127ecab72c53000e3da60fa670.exe

Files

NEAS.b09478127ecab72c53000e3da60fa670.exe
.exe windows:4 windows x86 arch:x86

01595b4f558d59e9304f6b5ab49a893c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RegisterConsoleOS2
PackageIdFromFullName
GetPackagesByPackageFamily
CreateSymbolicLinkTransactedW
InterlockedDecrement
OpenPackageInfoByFullName
GetComputerNameExW
GetFileMUIInfo
DisableThreadProfiling

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE