NEAS[.]ee15b7f06937e7962c22d8f08054dc40[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.ee15b7f06937e7962c22d8f08054dc40.exe
Size

66KB
MD5

ee15b7f06937e7962c22d8f08054dc40
SHA1

e9709c867e0cc982891dec1d802c64c3215dfb2c
SHA256

8c8c4cdaa8a1cbca36891a96bde56271be71ab014ea598f07bcc7817b2ed2570
SHA512

7a6f7de41769fe78f32ce5a5daa247488a896d7026b6def3618c68d54f91286af994c344e355daf6cbe542a42b623f90d345c77118ab780e9bdc0e41f5417a14
SSDEEP

1536:y3dK5NfWcUEthtkBdxbv9B5j8N2tZpHcXx+yhi7sxffMTZ9GkjVAsdVKmL+:ys+WkBdxA2tfHeYLCMTZ9BImL+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.ee15b7f06937e7962c22d8f08054dc40.exe

Files

NEAS.ee15b7f06937e7962c22d8f08054dc40.exe
.exe windows:4 windows x86

b6ffba4d2e874a4b1da7b8ccebe91091

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

K32EnumProcessModulesEx
SetupComm
FindFirstFileExA
RegisterBadMemoryNotification
K32GetMappedFileNameA
ApplicationRecoveryFinished
RemoveDirectoryTransactedW
VirtualLock
AddConsoleAliasA
MoveFileWithProgressW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE