NEAS[.]b0d53fb5bcbe071cf9748f93a13a9067c52615f7257f3e6025567c180f094849exe_JC[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.b0d53fb5bcbe071cf9748f93a13a9067c52615f7257f3e6025567c180f094849exe_JC.exe
Size

4.0MB
MD5

0d01312113f384269b563141f330c83f
SHA1

7e1a70489aa0467b872ebf3996270edf41554f15
SHA256

b0d53fb5bcbe071cf9748f93a13a9067c52615f7257f3e6025567c180f094849
SHA512

0fe07141219c9de5165ca2a23c6c7daa81410f13bc5108446e7d041d965128e3dc779eaae035c2d03439a128733469ec6832663c826f64a2989ad2a8823bca54
SSDEEP

98304:X7+S7Uw6qSrXT8TWHoS7Uw6qSrXT8TWHxmd:XiS7UwHS7TuWHoS7UwHS7TuWHxmd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.b0d53fb5bcbe071cf9748f93a13a9067c52615f7257f3e6025567c180f094849exe_JC.exe

Files

NEAS.b0d53fb5bcbe071cf9748f93a13a9067c52615f7257f3e6025567c180f094849exe_JC.exe
.exe windows:4 windows x86

43064c3f26ad08fbdd86b66cff92ab66

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

winmm

PlaySoundA

kernel32

FreeLibrary
GetProcAddress
GetSystemDirectoryA
LoadLibraryA
MoveFileA
SetFilePointer
WritePrivateProfileStringA
GetShortPathNameA
MoveFileExA
GetDiskFreeSpaceA
lstrcpynA
WideCharToMultiByte
CreateEventA
SetErrorMode
GetModuleFileNameA
GetWindowsDirectoryA
TlsSetValue
SetUnhandledExceptionFilter
DeleteCriticalSection
TlsFree
InterlockedDecrement
TlsGetValue
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
VirtualQuery
IsBadReadPtr
GetCurrentThread
ReadProcessMemory
IsBadWritePtr
SetEndOfFile
InitializeCriticalSection
TlsAlloc
VirtualUnlock
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetVersionExA
GetCurrentProcess
GetModuleHandleA
HeapFree
GetCurrentThreadId
TerminateProcess
GetExitCodeProcess
GetVersion
OutputDebugStringA
HeapAlloc
GetSystemInfo
SetEvent
SetThreadPriority
CreateThread
GetTickCount
Sleep
GetVolumeInformationA
GetFileAttributesA
SetCurrentDirectoryA
lstrcmpA
DeleteFileA
GetEnvironmentVariableA
SetLastError
lstrlenA
lstrcpyA
lstrcatA
ExitProcess
GetLastError
FormatMessageA
GetLocalTime
MultiByteToWideChar
WaitForSingleObject
CreateProcessA
SetVolumeLabelA
GetDriveTypeA
WriteFile
GetFileSize
ReadFile
VirtualLock
CloseHandle
RaiseException
FlushFileBuffers
CreateFileA
FindNextFileA
lstrcmpiA
FindFirstFileA
CreateDirectoryA
FindClose
RemoveDirectoryA
VirtualAlloc
GetCurrentDirectoryA
GetProcessHeap
GetFullPathNameA
VirtualFree
GetStringTypeA
GetOEMCP
GetCPInfo
SetStdHandle
HeapCreate
HeapDestroy
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
LCMapStringW
LCMapStringA
HeapSize
HeapReAlloc
GetCommandLineA
GetStartupInfoA
ExitThread
ResumeThread
RtlUnwind
GetStringTypeW
IsBadCodePtr
GetACP

user32

ReleaseCapture
SetWindowLongA
GetDlgItemTextA
GetDlgItem
SetFocus
MessageBeep
CallWindowProcA
InvalidateRect
PeekMessageA
TranslateMessage
DispatchMessageA
ShowCursor
DestroyWindow
EnableWindow
SetCursor
GetParent
ExitWindowsEx
GetDC
ReleaseDC
GetWindowRect
SetWindowPos
LoadStringA
KillTimer
WaitForInputIdle
SetTimer
EndDialog
SetDlgItemTextA
DialogBoxParamA
wvsprintfA
MessageBoxA
wsprintfA
SetActiveWindow
LoadCursorA
SetCapture
EndPaint
GetWindowTextA
BeginPaint
ShowWindow
RegisterWindowMessageA
CreateWindowExA
GetWindowLongA
GetDesktopWindow
DestroyCursor
GetForegroundWindow
CreateCursor
RegisterClassA
IsWindow
IsWindowVisible
SetClassLongA
MoveWindow
WaitMessage
FindWindowA
GetLastActivePopup
GetTopWindow
SetForegroundWindow
DefWindowProcA
GetActiveWindow
PostQuitMessage
LoadIconA
LoadImageA
RegisterClassExA
GetSystemMetrics
AdjustWindowRect
PostMessageA
SetWindowTextA
SendMessageA

gdi32

BitBlt
SetPaletteEntries
DeleteObject
SetDIBColorTable
RealizePalette
SelectPalette
CreatePalette
CreateCompatibleDC
CreateDIBSection
SelectObject
GetStockObject
GetDeviceCaps
GetSystemPaletteEntries
DeleteDC

comdlg32

GetSaveFileNameA

advapi32

RegDeleteValueA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegSetValueExA
RegDeleteKeyA
RegEnumValueA
RegEnumKeyA
RegQueryInfoKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
GetUserNameA

shell32

SHGetSpecialFolderLocation
SHGetFileInfoA
SHGetMalloc
ShellExecuteA
FindExecutableA
SHGetDesktopFolder

ole32

CoInitialize
CoCreateInstance

Sections

.text
Size: 224KB - Virtual size: 221KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

43064c3f26ad08fbdd86b66cff92ab66

Headers

File Characteristics

Imports

version

winmm

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

Sections

.text Size: 224KB - Virtual size: 221KB

.rdata Size: 20KB - Virtual size: 16KB

.data Size: 16KB - Virtual size: 57KB

.rsrc Size: 24KB - Virtual size: 20KB

.text
Size: 224KB - Virtual size: 221KB

.rdata
Size: 20KB - Virtual size: 16KB

.data
Size: 16KB - Virtual size: 57KB

.rsrc
Size: 24KB - Virtual size: 20KB