Static task
static1
Behavioral task
behavioral1
Sample
NEAS.4d3e97d569a8f73108112d0adaa55c9c679fc2a432875ac76db1c7c566ba035cexe_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.4d3e97d569a8f73108112d0adaa55c9c679fc2a432875ac76db1c7c566ba035cexe_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.4d3e97d569a8f73108112d0adaa55c9c679fc2a432875ac76db1c7c566ba035cexe_JC.exe
-
Size
554KB
-
MD5
a6269ad0f6a5fdeab347e9a5ec96fe03
-
SHA1
726b20e5b383076efba4dcc5226e43502bc7bbb6
-
SHA256
4d3e97d569a8f73108112d0adaa55c9c679fc2a432875ac76db1c7c566ba035c
-
SHA512
ddf72e075560fab79c1413dc5928f657a7dca2d7ed42825357358380fef48550aabef3e497d2c71cb62ebf8ddd55223514a75d6bba8c57627569b6d097b5810e
-
SSDEEP
6144:+wV2zb9+pn3BjAVkFVWwKgWfK948r40OZuW0SEkqZt8DPozcv/4Bx1ErHm1AIQVt:Di4pn3BCkFVRKgWS948r40OZhNhfr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.4d3e97d569a8f73108112d0adaa55c9c679fc2a432875ac76db1c7c566ba035cexe_JC.exe
Files
-
NEAS.4d3e97d569a8f73108112d0adaa55c9c679fc2a432875ac76db1c7c566ba035cexe_JC.exe.exe windows:5 windows x86
b42856b54645aa24809a30270d5556cf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
netapi32
NetUserChangePassword
kernel32
DeleteCriticalSection
DecodePointer
IsDebuggerPresent
DebugBreak
GetModuleFileNameA
GetCurrentProcessId
GetCurrentThreadId
ExitProcess
WaitForSingleObject
ResetEvent
CreateProcessW
CloseHandle
SetEvent
InterlockedCompareExchange
SwitchToThread
GetModuleHandleExW
GetModuleFileNameW
GetFileAttributesW
CreateEventW
CreateMutexW
CreateThread
InterlockedExchange
ReleaseMutex
WaitForMultipleObjects
InterlockedExchangeAdd
InterlockedIncrement
InterlockedDecrement
SetLastError
GetStdHandle
GetConsoleCP
GetConsoleOutputCP
GetACP
GetOEMCP
GetFileType
GetFileSizeEx
WriteConsoleW
WriteFile
ReadConsoleW
ReadFile
WideCharToMultiByte
MultiByteToWideChar
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
OutputDebugStringA
CreateFileA
RtlCaptureStackBackTrace
LocalFree
lstrlenW
FormatMessageW
GetModuleHandleW
GetProcAddress
CompareStringW
FreeLibrary
RaiseException
VerSetConditionMask
GetSystemDirectoryW
LoadLibraryW
GetModuleHandleA
LoadLibraryExW
OutputDebugStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
GetCommandLineA
HeapFree
HeapAlloc
GetStringTypeW
CreateFileW
HeapSize
HeapReAlloc
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
FlushFileBuffers
SetFilePointerEx
EncodePointer
GetLastError
InitializeCriticalSectionAndSpinCount
GetCommandLineW
GetCurrentProcess
user32
GetProcessWindowStation
MessageBoxA
wsprintfA
GetUserObjectInformationW
advapi32
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
Sections
.text Size: 169KB - Virtual size: 168KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 89KB - Virtual size: 89KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 274KB - Virtual size: 273KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ