NEAS[.]6ba15df0c489bf343c5cb7b097ed5840[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.6ba15df0c489bf343c5cb7b097ed5840.exe
Size

119KB
MD5

6ba15df0c489bf343c5cb7b097ed5840
SHA1

2faf720cc81e3ede18279e43b117c245eaea6a6d
SHA256

a19a0f8994bf497a1983d924933ddad4ee9261c5d85c6dbf8fa4f2ce9294b5c6
SHA512

c3b9d22435eebf55e6af4be576e10ef1ade405cace2ea7354b36d3cc1c85acf3be6323c78fb8ddc0bade3d383f97e742b916ff2360e080f8c4580a83dd316ffa
SSDEEP

3072:k1l7OmgmrNyZJeoVkfL75KIiAYWmrcKpIM:Yxgm8eo6fLcIiDWmo+IM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.6ba15df0c489bf343c5cb7b097ed5840.exe

Files

NEAS.6ba15df0c489bf343c5cb7b097ed5840.exe
.exe windows:4 windows x86 arch:x86

b6aebc38a6d10d67774f94e337794170

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

NtVdm64CreateProcessInternalW
FindResourceExA
WriteProfileSectionA
RtlMoveMemory
GetFileAttributesTransactedW
GetThreadPreferredUILanguages
_hread
AllocateUserPhysicalPages
SleepConditionVariableSRW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE