NEAS[.]5f0356b04d3b7e32e8397aef04b15201_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.5f0356b04d3b7e32e8397aef04b15201_JC.exe
Size

26KB
MD5

5f0356b04d3b7e32e8397aef04b15201
SHA1

56798f683b6c922a83b087a8d4db5ce4b7797790
SHA256

4e15f95865294341267cd588ccf2643a90cb5b64e36c240f7cdff67d63badb70
SHA512

6b7a7cde4b1833395ba98113e204ce46b1d77eafcf7b05aa32148a0a740617ce45facb8ef1fddd7677e96a5768bb397abf385144144187993216f6c35f71f7d0
SSDEEP

384:FRC2JQ6xWIhJAWSIAUcFe8ysphRoFjQFxGENoJTlx3i:bBdxWIhBzAUcFOs7RoFjQFxGao

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.5f0356b04d3b7e32e8397aef04b15201_JC.exe

Files

NEAS.5f0356b04d3b7e32e8397aef04b15201_JC.exe
.exe windows:4 windows x86

ff927df9041610851956a3da8805d6dd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualProtect
LoadLibraryA
ExitProcess
GetProcAddress

advapi32

AreAllAccessesGranted
AddUsersToEncryptedFile

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 268B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 37B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE