5a8b686388e417adc2a3c31e400eb8d0_NEAS | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5a8b686388e417adc2a3c31e400eb8d0_NEAS
Size

2.7MB
MD5

5a8b686388e417adc2a3c31e400eb8d0
SHA1

810a27df9a46d6d124ca314de44ce7d3e7edcdbf
SHA256

47177300775cfaea3545658994a19bd71febb3a60a824012497bfe929a23c6b8
SHA512

94c8b137b3645143e873e1889445d5bfaf9b831d4f1b40e663ae5eb465a9ae886329bc141eb1decdffc777b1133bbbac584035928356cb1592e324eaf540da4b
SSDEEP

49152:JvFC+R2zNsnKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aM:JM+RYNAKvkTgXuquveY+W2o8oT3ezMr1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5a8b686388e417adc2a3c31e400eb8d0_NEAS

Files

5a8b686388e417adc2a3c31e400eb8d0_NEAS
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\Office\Target\x86\ship\postc2r\x-none\msohtmed.pdb

Sections

.text
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.c2r
Size: 512B - Virtual size: 260B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ