NEAS[.]39b80f5fa7d0a0608b13c6d7f3a9c14f_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.39b80f5fa7d0a0608b13c6d7f3a9c14f_JC.exe
Size

319KB
MD5

39b80f5fa7d0a0608b13c6d7f3a9c14f
SHA1

3863dec1c7578ffbd043592f58807fac47a4a202
SHA256

223add1850fc0aed1418aa0e2bdf296bd510ff77ea9bb432d689b6dab67cba55
SHA512

255711822b24bcac7fa71ea4e860450cfebd20923f93eda14ee5a9f9428d104c91e97b3e0ef42e25422af532913f14ee043b811ba793e364f189bfb2677af185
SSDEEP

6144:Zt58sOQf6lghcnBBLf9tQiepbGjhboOBnSusSTUvXBirw/AwFFz:ZtisOQf6lXbpt/kbGjhV5AvXxHD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.39b80f5fa7d0a0608b13c6d7f3a9c14f_JC.exe

Files

NEAS.39b80f5fa7d0a0608b13c6d7f3a9c14f_JC.exe
.exe windows:5 windows x86

06ef33a1c45fdabdfa5b6e2e08bce5aa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

LoadCursorW

advapi32

RegQueryValueExW

shell32

ShellExecuteA

ws2_32

htonl

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 289KB - Virtual size: 404KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 24B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE