NEAS[.]ea6880ef87c882510015bf35846b9ed0[.]exe | Triage

Sharing

General

Target

NEAS.ea6880ef87c882510015bf35846b9ed0.exe
Size

4.9MB
MD5

ea6880ef87c882510015bf35846b9ed0
SHA1

e88625710f3f99aa7d85cc6f148e1d3db1988106
SHA256

03dbee4488ae08865bd149aaa4bc452c7a2b24934ba375c6ab807b310723cbbe
SHA512

93b520dd005a99d62b7057cb0ae76399a6804ba499cde45be8e0fde19ad4db8d1b2b4647c3e66605507c9eb5f573b179d97fbe4066903c7d9379ed1c3df87e51
SSDEEP

98304:SE7i9OKl1KR68IZN1v4oXxY1Q3g9zZRSMN4AOrqr/U4qIczE+CQJXX5m6W+CdOT4:SEOXl1EIZHAX1QECMNvrv2PCQJXXCHO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.ea6880ef87c882510015bf35846b9ed0.exe

Files

NEAS.ea6880ef87c882510015bf35846b9ed0.exe
.exe windows:1 windows x86

140094f13383e9ae168c4b35b6af3356

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateThread
ExitProcess
GetComputerNameA
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
SetErrorMode
Sleep
VirtualAllocExNuma

shlwapi

PathFindFileNameA

msvcrt

malloc
free
memset
strcmp
_strcmpi
strcpy

Sections

.text
Size: 4.8MB - Virtual size: 4.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 508B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ