NEAS[.]3de3e7994683a03c63f8dfc766c71af0_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.3de3e7994683a03c63f8dfc766c71af0_JC.exe
Size

2.0MB
MD5

3de3e7994683a03c63f8dfc766c71af0
SHA1

064c89773b574c65dc5a1251644ed5c62f39b7eb
SHA256

d636b03f1c4aecfc61d1cf1b12d9a696d63aa95d366cc79e26d0b82bd0af7008
SHA512

67ef076eb3c25b274fcb235ff67392151a9dfec651dd325d7562e7807409b10292c43e8473f658e84d8c23b3cbb50416c178ea2164b836dbc76d19331f29d584
SSDEEP

49152:W+K5wHJw8eOT4rwu1P6DQiYpWdzIV/3y:W+K6Jx/T4rWS/3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.3de3e7994683a03c63f8dfc766c71af0_JC.exe

Files

NEAS.3de3e7994683a03c63f8dfc766c71af0_JC.exe
.dll windows:6 windows x86

0f3aa4f53ef3e1fbfe68e04fd1593edc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
DisableThreadLibraryCalls
GetDriveTypeA
GetComputerNameA
LoadLibraryA
LoadLibraryExA
GetModuleFileNameA
FreeLibrary
LoadLibraryW
OutputDebugStringA
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
SetLastError
GetLastError
OutputDebugStringW
lstrcpynA
lstrcpyA
lstrcatA
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
CloseHandle
FindAtomW
DeleteCriticalSection
InitializeCriticalSectionEx
GetTickCount
FindResourceA
SizeofResource
LockResource
LoadResource
FreeResource
lstrlenA

user32

SetPropW
DefWindowProcA
RegisterClassA
UnregisterClassA
CreateWindowExA
DestroyWindow
LoadImageA
AdjustWindowRectEx
GetDesktopWindow
RemovePropA
EnumDisplayMonitors
wsprintfA
GetSystemMetrics
IsWindowEnabled
GetParent
GetClientRect
SetWindowPos
SetFocus
GetDC
GetFocus
ReleaseDC
BeginPaint
GetWindowRect
ClientToScreen
EndPaint
SetPropA
GetPropA
MoveWindow
GetSysColor
GetMonitorInfoA
EnableWindow
FindWindowA
GetPropW

gdi32

DeleteObject
GetDeviceCaps
CreateDCA
CreateCompatibleDC
BitBlt
CreateSolidBrush
SelectObject
CreateDIBSection
GetDIBColorTable
GetObjectA
GetClipBox
GetStockObject
PatBlt
DeleteDC
GetCharWidthA
CreateFontIndirectA

advapi32

RegQueryValueExA
RegOpenKeyA
RegCloseKey

msvcp140

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z

vcruntime140

strrchr
memchr
__std_exception_destroy
memcmp
strchr
memmove
__RTtypeid
__CxxFrameHandler3
__std_type_info_compare
_CxxThrowException
_except_handler4_common
__std_exception_copy
__std_type_info_destroy_list
strstr
_purecall
__std_terminate
memcpy
memset

api-ms-win-crt-time-l1-1-0

clock

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
_errno
_invalid_parameter_noinfo
_set_invalid_parameter_handler
_invalid_parameter_noinfo_noreturn
_configure_narrow_argv
_initterm_e
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_initterm

api-ms-win-crt-string-l1-1-0

strlen
strcmp
isalpha
isxdigit
isspace
iswalpha
iswcntrl
towlower
wcslen
isdigit
strncpy_s
isprint
islower
strncmp
toupper
tolower
wcsncpy
_stricmp
strpbrk
isupper
_strlwr
isalnum
strncat
_strdup

api-ms-win-crt-convert-l1-1-0

strtol
_itoa_s
_strtoui64
atoi
mbstowcs_s
atof
atol

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s
__stdio_common_vsnprintf_s
_sopen_dispatch
_read
_close
__stdio_common_vsscanf
__stdio_common_vfprintf
fputc
fflush
__acrt_iob_func
_wsopen_dispatch
__stdio_common_vsprintf

api-ms-win-crt-utility-l1-1-0

labs

api-ms-win-crt-math-l1-1-0

ldexp
sin
acos
cos
_except1
modf

api-ms-win-crt-heap-l1-1-0

realloc
malloc
free
_callnewh
calloc

api-ms-win-crt-filesystem-l1-1-0

_fstat64i32

api-ms-win-crt-multibyte-l1-1-0

_mbsstr

Exports

Exports

PlugInMain

Sections

.text
Size: 957KB - Virtual size: 957KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 353KB - Virtual size: 352KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 85KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 550KB - Virtual size: 552KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0f3aa4f53ef3e1fbfe68e04fd1593edc

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

msvcp140

vcruntime140

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

Exports

Exports

Sections

.text Size: 957KB - Virtual size: 957KB

.rdata Size: 353KB - Virtual size: 352KB

.data Size: 85KB - Virtual size: 96KB

.rsrc Size: 138KB - Virtual size: 137KB

.reloc Size: 550KB - Virtual size: 552KB

.text
Size: 957KB - Virtual size: 957KB

.rdata
Size: 353KB - Virtual size: 352KB

.data
Size: 85KB - Virtual size: 96KB

.rsrc
Size: 138KB - Virtual size: 137KB

.reloc
Size: 550KB - Virtual size: 552KB