NEAS[.]49d4c37dd77f0ae35ac4b15c10b3f120[.]exe | Triage

Sharing

General

Target

NEAS.49d4c37dd77f0ae35ac4b15c10b3f120.exe
Size

119KB
MD5

49d4c37dd77f0ae35ac4b15c10b3f120
SHA1

5306431ef9aee560b677493f46e596cec1568a75
SHA256

bdc0b094e9a18bab5a14ca35e42f1c1810af01486c06d228d9ea4dc036ccea77
SHA512

c86c1b23f1e6f5be38a380bcea61fe720cdd111194329572edf881dbd1da3d47a2e3a4030a13d4b6176e4370a6af230af4024acb4965dcd9ea3afc1c24995e23
SSDEEP

3072:ZVSszcfTlApoEs7OIo5Pu8v2kp5zXnimcEsYY4aJz/cMjrKw/K:ZVFoEs7M88vhjnCEsYYnJLnOwC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.49d4c37dd77f0ae35ac4b15c10b3f120.exe

Files

NEAS.49d4c37dd77f0ae35ac4b15c10b3f120.exe
.exe windows:4 windows x86 arch:x86

f99ebdb0f5fe94510c65d898f97e06f5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindFirstVolumeMountPointW
GetFileInformationByHandle
TermsrvOpenUserClasses
GetMaximumProcessorGroupCount
GetStringTypeExW
GetPackagePath
CreateFiber
FindFirstChangeNotificationW
GetThreadSelectedCpuSets

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE