NEAS[.]eaeb78e8ff192342a7e7406858c54780[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.eaeb78e8ff192342a7e7406858c54780.exe
Size

66KB
MD5

eaeb78e8ff192342a7e7406858c54780
SHA1

2b52e9d7b0765ff4ad5ae0918e4c4f3153abca9d
SHA256

26ddd631250e4272ccb207b019393515ad3fea515f40c9cd2935935adb3fe626
SHA512

7a951c080deb1ea24c1fc87303ce054e3ce5ce9337e2933b2fd8e1db05e441d2e520d05abaa9afe87c2e6e271e8d3c7ae0e9a78f7179af9269261036ff770a1f
SSDEEP

1536:6OTdOxaiA4tj5ak7av3QPqbYGxknlrJPELP6rfU9mZJLSGB:6OTd8vOIPqb/xkrJPELe8QZQe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.eaeb78e8ff192342a7e7406858c54780.exe

Files

NEAS.eaeb78e8ff192342a7e7406858c54780.exe
.exe windows:4 windows x86

077593f66ad49c25ff0532d7277a8b47

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindNextStreamW
SetEvent
K32GetPerformanceInfo
WerpInitiateRemoteRecovery
GetModuleFileNameA
PeekNamedPipe
DisassociateCurrentThreadFromCallback
DeleteFileA
BasepGetComputerNameFromNtPath
CreateDirectoryW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE