NEAS[.]eef86be2ce4882e6a6dd5b9442ede6b0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.eef86be2ce4882e6a6dd5b9442ede6b0.exe
Size

119KB
MD5

eef86be2ce4882e6a6dd5b9442ede6b0
SHA1

1dbdad5c611c49ff923927f3a6ad42d60e1a2d20
SHA256

b748a624478cb842d9bbd52ac7371822fff668e51ac95cdfd8fc8dec6640263d
SHA512

2cd24f88abfea28c862fcaae529c4e1221f0a7dc9e2185bf6f9b2f79538cfc52c15d857dbb8610226aecf3e2aba123426c8add5dd13b25dbae26fec3903387b6
SSDEEP

3072:IQ7vDsPUU0XOK9oCrDT1PucQ/SFpVrf05bFt4:YPJOo8cDsrMC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.eef86be2ce4882e6a6dd5b9442ede6b0.exe

Files

NEAS.eef86be2ce4882e6a6dd5b9442ede6b0.exe
.exe windows:4 windows x86

9f711ac20fb2e03a08998b0c844c3b01

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetNamedPipeHandleStateA
GetQueuedCompletionStatusEx
CreateMailslotA
QueryIoRateControlInformationJobObject
QuirkIsEnabledWorker
CreateDirectoryA
UnregisterApplicationRestart
Thread32First
UpdateProcThreadAttribute

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE