NEAS[.]0ee8a4fb058f190231a240b99a8faea0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.0ee8a4fb058f190231a240b99a8faea0.exe
Size

97KB
MD5

0ee8a4fb058f190231a240b99a8faea0
SHA1

937de20143c10f4d31dd25b6505fab5228beb3b8
SHA256

96d4d41fa9241cc95e8ba7ebf82a5f6624eedd0b50a79b6761759b4bf9d9eb8b
SHA512

14e6c76f640da3e281adabf6ab4a2b4e54b13e61b7b66bf1cfdfe4a6d3fa2097bea0980826c40bab5e762544a2005afc93b09cb536c015beeeb06770e7181598
SSDEEP

1536:OVNSf7hyk+I6412V6PMqAax80XAFSrRHa:SSf9yk+U2V63XAFSrRHa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.0ee8a4fb058f190231a240b99a8faea0.exe

Files

NEAS.0ee8a4fb058f190231a240b99a8faea0.exe
.exe windows:5 windows x86

0387d7197769bd3cd788524003bf2efa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

user32

EndPaint

advapi32

RegCloseKey

shell32

ShellExecuteA

ws2_32

WSAStartup

iphlpapi

GetAdaptersAddresses

Sections

.MPRESS1
Size: 39KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE