NEAS[.]5cc33b1731068e3d31ece2ba0b07e5e0_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.5cc33b1731068e3d31ece2ba0b07e5e0_JC.exe
Size

783KB
MD5

5cc33b1731068e3d31ece2ba0b07e5e0
SHA1

1c07d76966b52f5331477ded994a754ed43f83c5
SHA256

0f0c1ef05adb737e1d5a3fc855af4ff757fde8365693fc2f389677b33e186102
SHA512

5b4e6f2a13d395841bc47a5201bb748ee482a56fe071bb05ca9e87b482da2d7c563e3cd6f3b22708971f8794b5824cd34c46fad5497d87680e66b1c732e1d877
SSDEEP

24576:SD2AxwRyGapNllfSfkLrzripHUC4mnNpHT2kjGWGQM:SxDofEr6pHf4KNpHTTj1/M

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.5cc33b1731068e3d31ece2ba0b07e5e0_JC.exe

Files

NEAS.5cc33b1731068e3d31ece2ba0b07e5e0_JC.exe
.exe windows:4 windows x86

52799a6a411e70653d29649cc8cb671b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
CreateProcessA
DeleteFileA
GetModuleFileNameA
WaitForSingleObject
CreateDirectoryA
GetWindowsDirectoryA
GetStartupInfoA

user32

GetWindowThreadProcessId
SetWindowPos

msvcrt

time
ftell
fopen
_controlfp
memcpy
_rmdir
strcat
strcpy
fclose
fwrite
fread
fseek
_fsopen
_XcptFilter
sprintf
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
__getmainargs
calloc
free
_exit
__setusermatherr
exit
_acmdln
_initterm
__set_app_type
_adjust_fdiv
__p__commode
__p__fmode
_except_handler3

Sections

.text
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ