NEAS[.]0c6f80a00fc810752344566b494e30b4b414ebf18a70a18334cb6c3a10492a0a_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.0c6f80a00fc810752344566b494e30b4b414ebf18a70a18334cb6c3a10492a0a_JC.exe
Size

2.5MB
MD5

e362c594d77aa6001521fb2b6cb112ae
SHA1

b030b309ca9f4bd3255feb60806d2baaa785eec6
SHA256

0c6f80a00fc810752344566b494e30b4b414ebf18a70a18334cb6c3a10492a0a
SHA512

f2ce6b1c9c6a2bea439ac192332919e1879611a7fa0bcd130aafbeb555b2392a979f128433c0855210c577bf5606b62f00d7d151bb16a9e81b0077987926d634
SSDEEP

49152:289yNlR4DygJgolbnj4FjHSj06iteQOiIWN3OEuGAoUv6++:28Crqj06iAXyZjAoU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.0c6f80a00fc810752344566b494e30b4b414ebf18a70a18334cb6c3a10492a0a_JC.exe

Files

NEAS.0c6f80a00fc810752344566b494e30b4b414ebf18a70a18334cb6c3a10492a0a_JC.exe
.exe windows:6 windows x86

5ba0fb70e6dd4e178549e81c3d19a2e9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

urlmon

URLDownloadToFileW

libcef

cef_v8value_create_function
cef_image_create
cef_stream_writer_create_for_file
cef_stream_writer_create_for_handler
cef_string_multimap_alloc
cef_string_multimap_free
cef_request_create
cef_task_runner_get_for_current_thread
cef_task_runner_get_for_thread
cef_menu_model_create
cef_response_create
cef_v8stack_trace_get_current
cef_post_data_create
cef_stream_reader_create_for_file
cef_stream_reader_create_for_data
cef_stream_reader_create_for_handler
cef_print_settings_create
cef_post_data_element_create
cef_v8value_create_array
cef_v8value_create_object
cef_v8value_create_string
cef_v8value_create_date
cef_v8value_create_double
cef_v8value_create_uint
cef_v8value_create_int
cef_v8value_create_bool
cef_v8value_create_null
cef_v8value_create_undefined
cef_v8context_in_context
cef_v8context_get_entered_context
cef_v8context_get_current_context
cef_process_message_create
cef_binary_value_create
cef_string_multimap_append
cef_string_multimap_value
cef_string_multimap_key
cef_string_multimap_size
cef_string_map_append
cef_string_map_value
cef_string_map_key
cef_string_map_size
cef_string_list_append
cef_string_list_value
cef_string_list_size
cef_create_context_shared
cef_request_context_create_context
cef_request_context_get_global_context
cef_drag_data_create
cef_list_value_create
cef_cookie_manager_create_manager
cef_cookie_manager_get_global_manager
cef_dictionary_value_create
cef_value_create
cef_execute_java_script_with_user_gesture_for_tests
cef_now_from_system_trace_time
cef_end_tracing
cef_begin_tracing
cef_is_cert_status_minor_error
cef_is_cert_status_error
cef_launch_process
cef_get_path
cef_write_json
cef_parse_jsonand_return_error
cef_parse_json
cef_uridecode
cef_uriencode
cef_base64decode
cef_base64encode
cef_get_extensions_for_mime_type
cef_get_mime_type
cef_format_url_for_security_display
cef_create_url
cef_parse_url
cef_clear_cross_origin_whitelist
cef_remove_cross_origin_whitelist_entry
cef_add_cross_origin_whitelist_entry
cef_get_geolocation
cef_load_crlsets_file
cef_zip_directory
cef_delete_file
cef_directory_exists
cef_create_temp_directory_in_directory
cef_create_new_temp_directory
cef_get_temp_directory
cef_create_directory
cef_set_crash_key_value
cef_crash_reporting_enabled
cef_enable_highdpi_support
cef_set_osmodal_loop
cef_quit_message_loop
cef_run_message_loop
cef_do_message_loop_work
cef_shutdown
cef_initialize
cef_execute_process
cef_clear_scheme_handler_factories
cef_register_scheme_handler_factory
cef_register_extension
cef_post_delayed_task
cef_post_task
cef_currently_on
cef_register_widevine_cdm
cef_is_web_plugin_unstable
cef_register_web_plugin_crash
cef_unregister_internal_web_plugin
cef_refresh_web_plugins
cef_visit_web_plugin_info
cef_api_hash
cef_command_line_get_global
cef_command_line_create
cef_string_map_free
cef_string_map_alloc
cef_string_userfree_utf16_free
cef_browser_host_create_browser_sync
cef_browser_host_create_browser
cef_string_list_free
cef_string_list_alloc
cef_string_wide_to_utf8
cef_log
cef_get_min_log_level
cef_string_utf16_set
cef_string_utf8_clear
cef_string_utf16_clear
cef_string_utf8_to_utf16
cef_string_utf16_to_utf8
cef_string_utf16_cmp
cef_time_now
cef_time_delta

shlwapi

ord219
PathFileExistsW
ord12

ws2_32

WSAAddressToStringW
GetAddrInfoW
WSAStartup
WSACleanup
inet_addr
FreeAddrInfoW
WSAGetLastError

crypt32

CryptBinaryToStringA

kernel32

SetEvent
RegisterWaitForSingleObject
UnregisterWait
CreateFileW
CancelIoEx
WaitForSingleObjectEx
CreateEventW
ReadDirectoryChangesW
GetStdHandle
CreateDirectoryW
WaitForSingleObject
WaitForMultipleObjects
GetExitCodeProcess
CreateThread
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
LocalFree
GetUserDefaultUILanguage
ReleaseMutex
CreateMutexW
ResetEvent
GetCurrentThread
LocalAlloc
VerSetConditionMask
ExpandEnvironmentStringsW
GetFileAttributesW
GetFullPathNameW
OutputDebugStringW
CreateProcessA
GetSystemDirectoryW
FreeLibrary
LoadLibraryExW
lstrcmpA
lstrcmpW
VerifyVersionInfoW
LCIDToLocaleName
GetCurrentThreadId
LoadResource
LockResource
SizeofResource
FindResourceW
LoadLibraryW
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
DeleteCriticalSection
GetCPInfo
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
VirtualProtectEx
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
GetThreadTimes
FreeLibraryAndExitThread
VirtualAlloc
VirtualFree
SetProcessAffinityMask
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
WaitForMultipleObjectsEx
RaiseException
RtlUnwind
MoveFileExW
DeleteFileW
HeapAlloc
HeapReAlloc
ExitThread
ResumeThread
HeapFree
ExitProcess
GetModuleFileNameA
WriteFile
GetACP
SetConsoleCtrlHandler
GetFileType
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointerEx
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
GetTimeZoneInformation
FindFirstFileExA
FindFirstFileExW
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
OutputDebugStringA
SetStdHandle
WriteConsoleW
ReadConsoleW
HeapSize
GetModuleHandleExW
WriteProcessMemory
ReadProcessMemory
GetCurrentProcess
GetVersionExW
SetEndOfFile
GetProcessTimes
GetProcessId
GetCurrentProcessId
GetModuleHandleW
VirtualProtect
GetProcAddress
RtlCaptureStackBackTrace
GetModuleHandleA
SetLastError
GetLastError
FindNextFileW
FindFirstFileW
FindClose
GetCurrentDirectoryW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetModuleFileNameW
GetTickCount
GetSystemInfo
OpenProcess
CreateProcessW
TerminateProcess
CloseHandle
GetCommandLineW
GetLocaleInfoW
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
DecodePointer
EncodePointer
GetNativeSystemInfo
GetExitCodeThread
Sleep
DuplicateHandle
GetStringTypeW
MultiByteToWideChar
QueryPerformanceFrequency
QueryPerformanceCounter
FormatMessageW
WideCharToMultiByte
SetThreadPriority

user32

GetWindow
RedrawWindow
MoveWindow
IntersectRect
InvalidateRect
GetMenuItemInfoW
GetForegroundWindow
SetCursor
EnableWindow
SetLayeredWindowAttributes
GetDoubleClickTime
RegisterRawInputDevices
GetRawInputData
MonitorFromPoint
GetWindowThreadProcessId
SetClassLongW
GetMessageTime
AttachThreadInput
UpdateWindow
GetCursorPos
GetKeyState
GetDC
ReleaseDC
SetWindowLongW
SystemParametersInfoW
SendMessageW
IsWindow
GetMenuBarInfo
PtInRect
UnionRect
FillRect
GetWindowDC
GetDCEx
DrawTextW
GetMenuItemRect
SetMenuInfo
GetMenuInfo
GetMenuItemCount
GetMenuStringW
GetMenu
IsIconic
GetWindowInfo
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
SetRectEmpty
ScreenToClient
ClientToScreen
RemovePropW
GetPropW
SetPropW
CallWindowProcW
TrackMouseEvent
SetParent
AdjustWindowRectEx
CopyRect
EndPaint
BeginPaint
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
DestroyWindow
PostMessageW
EnumDisplayDevicesW
EnumDisplaySettingsW
LoadCursorW
GetClientRect
CreateWindowExW
RegisterClassExW
DefWindowProcW
LoadImageW
EnableMenuItem
GetSystemMenu
GetSystemMetrics
SetFocus
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
AnimateWindow
AllowSetForegroundWindow
GetMonitorInfoW
MonitorFromWindow
MonitorFromRect
LoadIconW
GetWindowLongW
GetWindowRect
SetWindowTextW
SetForegroundWindow
IsZoomed
GetWindowPlacement
SetWindowPos
ShowWindow

gdi32

CreateRectRgn
SetTextColor
SetBkMode
SelectObject
SelectClipRgn
Rectangle
GetStockObject
ExcludeClipRect
DeleteObject
DeleteDC
CreateRectRgnIndirect
CreatePen
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
CreateSolidBrush
GetDeviceCaps
CreateFontIndirectW

shell32

SHGetFolderPathW
SHCreateDirectoryExW
SHGetKnownFolderPath
SHAppBarMessage
ShellExecuteExW
CommandLineToArgvW
ShellExecuteW

ole32

CoCreateInstance
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoTaskMemFree

oleaut32

SafeArrayGetElement
VariantClear
VariantInit
SysFreeString
SysAllocString
SetErrorInfo
GetErrorInfo
VariantChangeType
CreateErrorInfo

advapi32

DuplicateToken
CryptDestroyHash
CryptHashData
AllocateAndInitializeSid
AddAccessAllowedAce
AccessCheck
CryptCreateHash
OpenThreadToken
OpenProcessToken
RegGetValueW
FreeSid
GetLengthSid
InitializeAcl
InitializeSecurityDescriptor
IsValidSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
DeregisterEventSource
RegisterEventSourceW
ReportEventW
ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptAcquireContextW
CryptReleaseContext
CryptGetHashParam

wlanapi

WlanFreeMemory
WlanCloseHandle
WlanOpenHandle
WlanQueryInterface

iphlpapi

SendARP
GetIpInterfaceTable
FreeMibTable
GetIfTable2

dxgi

CreateDXGIFactory

gdiplus

GdipLoadImageFromFileICM
GdipLoadImageFromStreamICM
GdipLoadImageFromFile
GdipDrawImageRectI
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc
GdipDisposeImage
GdipGetImageWidth
GdipDeleteGraphics
GdipGetImageHeight
GdipLoadImageFromStream
GdipCreateFromHDC
GdipCloneImage

uxtheme

SetWindowTheme

d3d11

D3D11CreateDevice

d3d9

Direct3DCreate9Ex

d3dcompiler_47

D3DCompile

dwmapi

DwmEnableBlurBehindWindow

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 180KB - Virtual size: 179KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.crthunk
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.gfids
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 382KB - Virtual size: 382KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 624KB - Virtual size: 628KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5ba0fb70e6dd4e178549e81c3d19a2e9

Headers

DLL Characteristics

File Characteristics

Imports

urlmon

libcef

shlwapi

ws2_32

crypt32

kernel32

user32

gdi32

shell32

ole32

oleaut32

advapi32

wlanapi

iphlpapi

dxgi

gdiplus

uxtheme

d3d11

d3d9

d3dcompiler_47

dwmapi

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 180KB - Virtual size: 179KB

.data Size: 12KB - Virtual size: 21KB

.crthunk Size: 512B - Virtual size: 64B

.gfids Size: 6KB - Virtual size: 5KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 382KB - Virtual size: 382KB

.reloc Size: 624KB - Virtual size: 628KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 180KB - Virtual size: 179KB

.data
Size: 12KB - Virtual size: 21KB

.crthunk
Size: 512B - Virtual size: 64B

.gfids
Size: 6KB - Virtual size: 5KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 382KB - Virtual size: 382KB

.reloc
Size: 624KB - Virtual size: 628KB