NEAS[.]6e4ae0917e8149133f86df4ee822a955f21e0fedde109fd8d6ccbf3a377b4a45_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.6e4ae0917e8149133f86df4ee822a955f21e0fedde109fd8d6ccbf3a377b4a45_JC.exe
Size

1.2MB
MD5

ecbddc619f7d18aadc09cff8875f246f
SHA1

55b4077cd19c519fd9f44912ecd5dade6a23f6cf
SHA256

6e4ae0917e8149133f86df4ee822a955f21e0fedde109fd8d6ccbf3a377b4a45
SHA512

fc67cf08699c09db777afe5a701f2735615c4b601b5194425ad7137911bdb0aa2b4935b820768d61a8d8658e08012a4d38f1282bc5351f66e9bd608b7b81ff95
SSDEEP

24576:bAGUh+8h3GPIdigzgJevyvKXghf/rBdJPsDN3hYFKrBiXKbW65usyb2Qq+cVvVY7:bAGngV8rdsDLBrBiXKbMC+eVY7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.6e4ae0917e8149133f86df4ee822a955f21e0fedde109fd8d6ccbf3a377b4a45_JC.exe

Files

NEAS.6e4ae0917e8149133f86df4ee822a955f21e0fedde109fd8d6ccbf3a377b4a45_JC.exe
.exe windows:5 windows x86

e0ce797566e8bcb12743550ed27e89c7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WaitForSingleObject
CreateFileW
GetFileSize
ReadFile
FindFirstFileW
FindClose
CreateDirectoryW
GetFileAttributesW
SetFileAttributesW
DeleteFileW
MoveFileW
MoveFileExW
FileTimeToSystemTime
SetFilePointer
WriteFile
GetLocalTime
SystemTimeToFileTime
CreateFileA
LocalAlloc
LocalFree
InterlockedDecrement
HeapAlloc
HeapFree
VirtualFree
GetProcessHeap
IsBadReadPtr
SetLastError
VirtualAlloc
LoadLibraryA
VirtualProtect
GetCurrentDirectoryW
FindFirstFileExA
GetDriveTypeA
GetFileInformationByHandle
FileTimeToLocalFileTime
CreateProcessW
GetModuleFileNameW
WaitForMultipleObjects
TerminateProcess
GetDriveTypeW
GetVersionExW
GetNativeSystemInfo
GetCurrentProcess
GetModuleHandleW
FreeLibrary
ExpandEnvironmentStringsA
GetTempPathW
GetCurrentProcessId
GetTickCount
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
MultiByteToWideChar
WideCharToMultiByte
CreateMutexW
GetLastError
OpenProcess
GetExitCodeProcess
ExitProcess
LoadLibraryW
GetProcAddress
CreateThread
SetThreadPriority
SetFileTime
GetModuleHandleA
GetSystemDirectoryA
VerSetConditionMask
VerifyVersionInfoA
PeekNamedPipe
SleepEx
SetEnvironmentVariableA
CompareStringW
SetStdHandle
GetStringTypeW
GetTimeZoneInformation
IsValidCodePage
GetOEMCP
GetACP
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
ExitThread
GetCPInfo
LCMapStringW
GetStdHandle
GetFileType
WriteConsoleW
GetStartupInfoW
HeapSetInformation
GetCommandLineA
RtlUnwind
DeleteFileA
AreFileApisANSI
GetSystemTime
GetTempPathA
GetVersionExA
OutputDebugStringA
GetCurrentThreadId
GetFileAttributesExW
GetSystemInfo
GetDiskFreeSpaceA
CreateFileMappingW
CreateFileMappingA
GetDiskFreeSpaceW
LockFileEx
FlushFileBuffers
HeapValidate
HeapCreate
GetFileAttributesA
FormatMessageW
FormatMessageA
GetSystemTimeAsFileTime
UnlockFileEx
OutputDebugStringW
WaitForSingleObjectEx
LockFile
CloseHandle
Sleep
FlushViewOfFile
UnlockFile
QueryPerformanceCounter
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
TryEnterCriticalSection
InterlockedExchange
RaiseException
HeapDestroy
HeapReAlloc
HeapSize
InterlockedIncrement
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
InterlockedCompareExchange
GetFullPathNameW
GetFullPathNameA
HeapCompact

user32

wsprintfW
ShowWindow
PostMessageW
PostQuitMessage
IsZoomed
MonitorFromWindow
GetMonitorInfoW
ScreenToClient
GetClientRect
SetWindowRgn
IsIconic
GetWindowRect

gdi32

CreateRoundRectRgn
DeleteObject

advapi32

CheckTokenMembership
CryptHashData
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
AllocateAndInitializeSid
CryptGetHashParam
FreeSid
CryptDestroyHash
CryptAcquireContextA
CryptImportKey
CryptDestroyKey
CryptEncrypt
CryptReleaseContext
CryptCreateHash

shell32

SHFileOperationW
SHCreateDirectoryExW
ShellExecuteW

ole32

CoTaskMemFree
CoInitialize
CoUninitialize

oleaut32

VariantClear
SysFreeString
SysAllocString

shlwapi

PathFindFileNameW
PathFileExistsW
SHCreateStreamOnFileEx

ws2_32

connect
freeaddrinfo
getaddrinfo
sendto
socket
listen
ioctlsocket
gethostname
closesocket
getpeername
getsockopt
htons
bind
ntohs
setsockopt
WSAIoctl
send
WSACleanup
WSAStartup
WSASetLastError
__WSAFDIsSet
WSAGetLastError
select
accept
recv
getsockname
recvfrom

wldap32

ord211
ord143
ord60
ord50
ord26
ord30
ord200
ord32
ord35
ord79
ord33
ord301
ord27
ord41
ord46
ord22

psapi

GetModuleFileNameExW

wininet

InternetOpenA
HttpQueryInfoA
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetConnectA

Sections

.text
Size: 916KB - Virtual size: 915KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 12KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e0ce797566e8bcb12743550ed27e89c7

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

ws2_32

wldap32

psapi

wininet

Sections

.text Size: 916KB - Virtual size: 915KB

.rdata Size: 107KB - Virtual size: 107KB

.data Size: 12KB - Virtual size: 24KB

.rsrc Size: 34KB - Virtual size: 34KB

.reloc Size: 108KB - Virtual size: 108KB

.text
Size: 916KB - Virtual size: 915KB

.rdata
Size: 107KB - Virtual size: 107KB

.data
Size: 12KB - Virtual size: 24KB

.rsrc
Size: 34KB - Virtual size: 34KB

.reloc
Size: 108KB - Virtual size: 108KB