NEAS[.]5a1b7d38068dd5b0625eb75b9c9cd370_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.5a1b7d38068dd5b0625eb75b9c9cd370_JC.exe
Size

30KB
MD5

5a1b7d38068dd5b0625eb75b9c9cd370
SHA1

27389ae42388b0e2934a9c28e2e8a986b0ab237a
SHA256

bb465b78ee34a5497cd3c2c84a27a0b15572f1b6488cdfc20f4b0263e1b69490
SHA512

fb7575486852a52a7b259638f977c1cfa4a9f0c98fdf2ed544ec3f865708c2b045df5ee03af08e42f04afdc512783dbd0146f860a2b37f7c81210801bbbdd05e
SSDEEP

768:KSxfuSGx2RDeutdgI2MyzNORQtOflIwoHNV2XBFV72B4lA7ZsiZ+vsnzLMmjs/tA:Kyu8DeutdgI2MyzNORQtOflIwoHNV2Xo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.5a1b7d38068dd5b0625eb75b9c9cd370_JC.exe

Files

NEAS.5a1b7d38068dd5b0625eb75b9c9cd370_JC.exe
.exe windows:5 windows x86

688ad82d47fe4314040aa0041646c921

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdiplus

GdipCloneImage
GdiplusStartup
GdipCreateFromHDC
GdipBitmapGetPixel
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipDeleteGraphics
GdipFree
GdipAlloc

kernel32

LoadLibraryA
HeapAlloc
lstrcatW
OutputDebugStringW
LoadLibraryW
GetCurrentProcess
FindResourceW
LoadResource
SizeofResource
LockResource
VirtualAlloc
VirtualFree
FreeLibrary
GetProcAddress
GetProcessHeap

user32

ReleaseDC
BeginPaint
GetDesktopWindow
EndPaint
wvsprintfW

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 246B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ