NEAS[.]79f32ad8875d9c96a538ab5894973571_JC[.]exe | Triage

Sharing

General

Target

NEAS.79f32ad8875d9c96a538ab5894973571_JC.exe
Size

141KB
MD5

79f32ad8875d9c96a538ab5894973571
SHA1

f83a9084b7ef7e7031a061c69c254aa3156a17e1
SHA256

f47dac99ccfaf1d1e12273bfc0ec20db9bfa85a111b9c754ca9e209133f11a6e
SHA512

8f9a8dfab3e9274b0fd44ee9303d9b86f467a650366688895437e92eede201f5272347771914ca85f5879e898f17f9235f9df309a435997dc657cc267d57455f
SSDEEP

3072:K3kHmMsmRUOMfCECCeZlmgchdvz6xs9PY0X85jx08aAP52jKR2jKqRWX:zHbRUOqwC4mgg44jKojKqRy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.79f32ad8875d9c96a538ab5894973571_JC.exe

Files

NEAS.79f32ad8875d9c96a538ab5894973571_JC.exe
.exe windows:5 windows x86

ee5fe09a2db06623fb5eb479c3b63877

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

LoadIconW

advapi32

RegQueryValueExW

shell32

ShellExecuteA

ws2_32

WSAStartup

iphlpapi

GetAdaptersAddresses

Sections

.text
Size: 132KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE