NEAS[.]cea83e548096f6a1abb6e30d75f63ef6_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.cea83e548096f6a1abb6e30d75f63ef6_JC.exe
Size

304KB
MD5

cea83e548096f6a1abb6e30d75f63ef6
SHA1

3bf268bbfa38d89d2bd91f4a2183420d644de0a5
SHA256

8c50c8d5c3a774a804292102150606f4308b76ee8e862618e23f0dfb5bf27456
SHA512

5917083003733e98264176bc5f51f24ed6119eee3519cc01bb60f06db85a9bf9a0bb8f4959c849b17a4f8a7ee22d4503a808ce40620ca0e6041903b7b0ac31ec
SSDEEP

6144:UmDo8Wr6dOxqi+CUQEVIxyshp4EJBvLmYEWQJU6TnWbH:u8WdqidEhs44uJcb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.cea83e548096f6a1abb6e30d75f63ef6_JC.exe

Files

NEAS.cea83e548096f6a1abb6e30d75f63ef6_JC.exe
.exe windows:5 windows x86

3b3ca5844bdb8b6b333c1e673e18f1c8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetProcAddress
VirtualAlloc
VirtualFree
VirtualProtect

user32

GetDC

advapi32

RegCloseKey

shell32

ShellExecuteW

ws2_32

gethostbyaddr

iphlpapi

GetAdaptersInfo

oleacc

LresultFromObject

gdi32

SaveDC

winspool.drv

OpenPrinterW

oleaut32

VariantClear

Sections

.text
Size: 77KB - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 11KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 175KB - Virtual size: 217KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.EEEE
Size: 27KB - Virtual size: 28KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE