Static task
static1
Behavioral task
behavioral1
Sample
NEAS.5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0exe_JC.exe
Resource
win7-20230831-en
General
-
Target
NEAS.5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0exe_JC.exe
-
Size
269KB
-
MD5
aee08a1125541dfc8023ced782c61f5f
-
SHA1
5711732de88e477176787e1db168988479119331
-
SHA256
5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0
-
SHA512
326502281c6455c9e363cf266ccb514d93ae07b6084fc158a38a81ea56dd7d4210430b25c783727ed64183511ae678f5ab16b250200f05be3f22c562b36b5937
-
SSDEEP
3072:TzLoQaKk1daJj1MMjuqfFhNxlwfF7cQKhpPHrPsGkobjrVPfWD:XchuJ7juqf7Nv8qPHzPkw3A
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0exe_JC.exe
Files
-
NEAS.5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0exe_JC.exe.exe windows:5 windows x86
927e8ee399146237468353308c6002fe
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MoveFileExW
GetConsoleAliasA
InterlockedDecrement
GetCurrentProcess
GetEnvironmentStringsW
SetHandleInformation
OpenSemaphoreA
GetSystemDefaultLCID
FreeEnvironmentStringsA
GetModuleHandleW
GetTickCount
GenerateConsoleCtrlEvent
EnumTimeFormatsA
EnumTimeFormatsW
GetCommandLineA
TzSpecificLocalTimeToSystemTime
GetDriveTypeA
GetEnvironmentStrings
ActivateActCtx
GlobalAlloc
GetPrivateProfileIntA
LoadLibraryW
IsValidLocale
GetCalendarInfoA
SetVolumeMountPointA
SetConsoleCP
GetConsoleAliasW
TerminateProcess
GetStartupInfoW
CreateJobObjectA
InterlockedExchange
GetStartupInfoA
FindFirstFileA
SetLastError
CommConfigDialogA
EnumDateFormatsExA
RemoveDirectoryA
EnumSystemCodePagesW
GlobalGetAtomNameA
GlobalFree
GetNumaHighestNodeNumber
OpenMutexA
UnhandledExceptionFilter
GetFileType
MoveFileA
BuildCommDCBAndTimeoutsW
AddVectoredExceptionHandler
AddAtomW
GetProfileStringA
FindNextChangeNotification
FindNextFileA
GlobalUnWire
GetModuleHandleA
SetLocaleInfoW
FindNextFileW
CreateMailslotA
VirtualProtect
GetCurrentDirectoryA
EnumDateFormatsW
FatalAppExitA
GetShortPathNameW
SetThreadAffinityMask
OpenSemaphoreW
FindFirstVolumeW
ReadConsoleOutputCharacterW
EnumCalendarInfoExA
ReadFile
WriteConsoleW
GetVolumeNameForVolumeMountPointA
GetConsoleAliasExesA
EnumResourceNamesW
GetPrivateProfileSectionNamesW
GetCommandLineW
PeekConsoleInputW
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
WideCharToMultiByte
InterlockedIncrement
InterlockedCompareExchange
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
HeapAlloc
DeleteFileA
HeapSetInformation
GetCPInfo
RaiseException
RtlUnwind
LCMapStringW
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
GetProcAddress
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
CloseHandle
FreeEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetLocaleInfoW
HeapSize
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
HeapReAlloc
CreateFileW
user32
GetMessagePos
gdi32
SelectPalette
GetCharABCWidthsW
GetTextFaceW
advapi32
LookupAccountSidW
shell32
DragFinish
ole32
CoGetInstanceFromFile
winhttp
WinHttpSetOption
Sections
.text Size: 159KB - Virtual size: 159KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 91KB - Virtual size: 30.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ