Static task
static1
Behavioral task
behavioral1
Sample
NEAS.3be1313fefd598d46c5e626cbf6edb0e75b8ba8e59b0a088b164c9d4b15636a5exe_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.3be1313fefd598d46c5e626cbf6edb0e75b8ba8e59b0a088b164c9d4b15636a5exe_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.3be1313fefd598d46c5e626cbf6edb0e75b8ba8e59b0a088b164c9d4b15636a5exe_JC.exe
-
Size
430KB
-
MD5
1229ebb480bcef6e1af7eded7325b729
-
SHA1
ead5fbf5ca3c7e2fe6fcd993737e829a6f80f011
-
SHA256
3be1313fefd598d46c5e626cbf6edb0e75b8ba8e59b0a088b164c9d4b15636a5
-
SHA512
5de340b70337af554e97ea7e154a9c22561b1474b40760e9c2b642031122c082ec78eab1a91183565800f3d26c789f0a63a893b6928911785aa54df62557df09
-
SSDEEP
12288:2dfMqwxg7f0Q7a0TJXbqFzSdXE3qFtJLmb:2dkqT7sEfSz47k
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.3be1313fefd598d46c5e626cbf6edb0e75b8ba8e59b0a088b164c9d4b15636a5exe_JC.exe
Files
-
NEAS.3be1313fefd598d46c5e626cbf6edb0e75b8ba8e59b0a088b164c9d4b15636a5exe_JC.exe.exe windows:5 windows x86
2d6ee9078648d64c39536f6745a9c95e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MoveFileExW
GetConsoleAliasA
InterlockedDecrement
GetCurrentProcess
GetEnvironmentStringsW
SetHandleInformation
GetUserDefaultLCID
OpenSemaphoreA
FreeEnvironmentStringsA
GetModuleHandleW
GetTickCount
GenerateConsoleCtrlEvent
EnumTimeFormatsA
EnumTimeFormatsW
GetCommandLineA
GetDriveTypeA
GetEnvironmentStrings
GlobalAlloc
GetPrivateProfileIntA
LoadLibraryW
IsValidLocale
GetCalendarInfoA
SetVolumeMountPointA
SetConsoleCP
GetConsoleAliasW
TerminateProcess
GetStartupInfoW
CreateJobObjectA
InterlockedExchange
GetStartupInfoA
FindFirstFileA
OpenMutexW
SetLastError
CommConfigDialogA
RemoveDirectoryA
EnumSystemCodePagesW
GlobalFree
GetNumaHighestNodeNumber
UnhandledExceptionFilter
GetFileType
MoveFileA
BuildCommDCBAndTimeoutsW
AddVectoredExceptionHandler
AddAtomW
GlobalGetAtomNameW
FindNextChangeNotification
FindNextFileA
GlobalUnWire
GetModuleHandleA
SetLocaleInfoW
FindNextFileW
CreateMailslotA
VirtualProtect
GetCurrentDirectoryA
EnumDateFormatsW
FatalAppExitA
PeekConsoleInputA
GetShortPathNameW
SetThreadAffinityMask
OpenSemaphoreW
FindFirstVolumeA
ReadConsoleOutputCharacterW
EnumCalendarInfoExA
ReadFile
WriteConsoleW
GetConsoleAliasExesA
GetVolumeNameForVolumeMountPointA
EnumResourceNamesW
GetPrivateProfileSectionNamesW
GetCommandLineW
EnumDateFormatsExA
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
WideCharToMultiByte
InterlockedIncrement
InterlockedCompareExchange
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
HeapAlloc
DeleteFileA
HeapSetInformation
GetCPInfo
RaiseException
RtlUnwind
LCMapStringW
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
GetProcAddress
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
CloseHandle
FreeEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetLocaleInfoW
HeapSize
GetLocaleInfoA
EnumSystemLocalesA
HeapReAlloc
CreateFileW
user32
GetMessagePos
gdi32
SelectPalette
GetTextFaceW
GetCharABCWidthsW
advapi32
LookupAccountSidW
shell32
DragFinish
ole32
CoGetInstanceFromFile
winhttp
WinHttpSetOption
Sections
.text Size: 159KB - Virtual size: 158KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 253KB - Virtual size: 30.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ