NEAS[.]1d9ae22b90356e553ac532a8dfebe7f1_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.1d9ae22b90356e553ac532a8dfebe7f1_JC.exe
Size

1.1MB
MD5

1d9ae22b90356e553ac532a8dfebe7f1
SHA1

52c77135606e18d3c8ec014bb79f18fa8af2ddca
SHA256

adf6f9cdb3c2cb0f35ebec74ee775d5a15987651acb7a37dce7767216bc42e8b
SHA512

7088a6ee052bcd3fc489e28018355bd02431723d308017954ee0bdc0d4b0a3e2d369851b5081717bb8ebb030c2badaa0221218083b5e9f630c07fe616449fe7c
SSDEEP

12288:14qn6IcfBW4oi+I113q6fzm+OSw8rHRxMjJgLXIbR1kQ4+Sy0CV5BjvrEH7bi:a+6IiBWliZJQ8rN7Il6g0ErEH7e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.1d9ae22b90356e553ac532a8dfebe7f1_JC.exe

Files

NEAS.1d9ae22b90356e553ac532a8dfebe7f1_JC.exe
.exe windows:6 windows x86

65550315363f99ae3d270083b87eb80e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

TraceMessage
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
RegEnumValueW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegSetValueExA
CredGetSessionTypes
CredWriteW
RegCreateKeyExA
CredReadW
GetUserNameA
CredDeleteW
CredFree
CredReadDomainCredentialsW
CredWriteDomainCredentialsW
RegQueryValueExA
RegOpenKeyExA
CredUnmarshalCredentialW

kernel32

lstrlenW
RaiseException
FindFirstFileW
FindNextFileW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
UnmapViewOfFile
GetLocaleInfoW
CreateFileMappingW
MapViewOfFile
LoadLibraryExW
FindResourceW
LoadResource
HeapSetInformation
Sleep
InitializeCriticalSection
DeleteCriticalSection
FindClose
GetTempPathW
SetFilePointer
GetACP
SetLastError
GetFullPathNameW
GetFileAttributesW
lstrcmpW
CompareStringW
LocalAlloc
LocalFree
GetCurrentDirectoryW
GetVersionExW
GetCommandLineW
CreateDirectoryW
FormatMessageW
SearchPathW
DebugBreak
GetCurrentProcess
TerminateProcess
GetStartupInfoA
GetVersionExA
InterlockedCompareExchange
DeleteFileW
CreateFileW
GetFileSize
ReadFile
ExpandEnvironmentStringsW
CreateProcessW
TlsAlloc
TlsFree
LockResource
SystemTimeToFileTime
WriteFile
GetSystemTime
LoadLibraryA
ExpandEnvironmentStringsA
DeviceIoControl
HeapAlloc
GetProcessHeap
HeapFree
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
OutputDebugStringA
GetVersion
WideCharToMultiByte
InterlockedExchange
SizeofResource
MultiByteToWideChar
FreeLibrary
SetEvent
InterlockedDecrement
InterlockedIncrement
GetCurrentThreadId
CreateEventW
CreateThread
GetModuleFileNameW
lstrcmpiW
GetModuleHandleW
GetProcAddress
LoadLibraryW
WaitForSingleObject
VerSetConditionMask
VerifyVersionInfoW
LeaveCriticalSection
EnterCriticalSection
GetLocalTime
GetTimeFormatW
GetDateFormatW
GetCurrentProcessId
GetFileAttributesExW
CloseHandle
GetLastError
FindResourceExW

gdi32

GetDIBColorTable
CreatePalette
CreateRectRgn
CreateRectRgnIndirect
DeleteObject
SetRectRgn
GetDCOrgEx
GetClipBox
CombineRgn
EqualRgn
RealizePalette
SelectPalette
GetObjectW
GetStockObject
GetDeviceCaps
SelectObject
CreateCompatibleDC
UpdateColors
DeleteDC
BitBlt
CreateFontIndirectW
TranslateCharsetInfo
SetMapMode
SetBkMode
SetTextColor
StretchBlt
CreateCompatibleBitmap

user32

GetMessageW
SendMessageW
SetFocus
GetDlgItem
TranslateMessage
DispatchMessageW
CharUpperW
PostThreadMessageW
CharNextW
CopyRect
ShowWindow
EnableWindow
IsWindow
SetWindowTextW
LoadIconW
GetClassInfoExW
UnregisterClassW
SetRect
AdjustWindowRect
IsZoomed
LoadCursorW
SetCursor
AppendMenuW
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetSystemMetrics
CreateWindowExW
LoadAcceleratorsW
DialogBoxParamW
CreateDialogParamW
MessageBoxW
AllowSetForegroundWindow
KillTimer
SetTimer
RegisterClassExW
DefWindowProcW
DestroyWindow
SetForegroundWindow
IsChild
TranslateAcceleratorW
IsDialogMessageW
SystemParametersInfoW
GetClassInfoW
GetWindowLongW
SetWindowLongW
IsDlgButtonChecked
DefDlgProcW
RegisterClassW
SetDlgItemTextW
CheckDlgButton
EndDialog
PostMessageW
PtInRect
IsRectEmpty
MonitorFromWindow
GetMonitorInfoW
LoadStringW
UnregisterClassA
EqualRect
InsertMenuW
CreateMenu
ModifyMenuW
GetSystemMenu
MoveWindow
GetClientRect
SetWindowPos
SetWindowPlacement
EnableMenuItem
UpdateWindow
InvalidateRect
LockWindowUpdate
IsWindowVisible
PostQuitMessage
AdjustWindowRectEx
CharLowerW
FillRect
CheckRadioButton
GetCursorPos
GetWindowDC
DrawIconEx
GetFocus
MapDialogRect
ScreenToClient
GetWindow
DrawTextW
EnumDisplayMonitors
GetDesktopWindow
CreateDialogIndirectParamW
GetDlgItemTextW
MapWindowPoints
BeginPaint
DrawIcon
EndPaint
SendDlgItemMessageW
GetDC
ReleaseDC
DestroyIcon
GetMenu
LoadImageW
IsWindowEnabled
RedrawWindow
ShowWindowAsync

msvcrt

_errno
_wcsicmp
_vsnwprintf
iswdigit
_wtol
_wcslwr
calloc
__getmainargs
_cexit
_exit
_XcptFilter
wcsrchr
srand
time
iswspace
toupper
_wtoi
wcspbrk
_CIpow
towlower
_purecall
bsearch
wcstok
wcschr
memmove
_wcsnicmp
towupper
memcpy
_vsnprintf
wcsncmp
wcsstr
_fileno
_read
__pioinfo
__badioinfo
wcstombs
iswctype
_ismbblead
localeconv
isxdigit
isleadbyte
__mb_cur_max
mbtowc
isdigit
_controlfp
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
??2@YAPAXI@Z
memset
??_U@YAPAXI@Z
free
malloc
??_V@YAXPAX@Z
??3@YAXPAX@Z
realloc
__set_app_type
ungetc
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
wctomb

ole32

CoRevokeClassObject
StringFromGUID2
CoTaskMemFree
CoRegisterClassObject
CoUninitialize
CoInitialize
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance

oleaut32

SysAllocString
SysStringLen
LoadTypeLi
UnRegisterTypeLi
SafeArrayCreate
RegisterTypeLi
VarUI4FromStr
SafeArrayGetVartype
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SysStringByteLen
VariantClear
VariantInit
SysAllocStringByteLen
SysAllocStringLen
SysFreeString

shell32

SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetDesktopFolder
ShellExecuteExW
SHAddToRecentDocs
ExtractIconW

comctl32

ord17
ImageList_ReplaceIcon
ImageList_LoadImageW
ImageList_Create
ImageList_Destroy
InitCommonControlsEx

comdlg32

GetSaveFileNameW
GetOpenFileNameW
GetFileTitleW

shlwapi

PathFindExtensionW
PathAppendW
SHStrDupW
PathRemoveFileSpecW
PathStripPathW
PathFindFileNameW

crypt32

CertFreeCertificateContext
CertFreeCertificateChain
CryptBinaryToStringW
CryptStringToBinaryW
CertDuplicateCertificateContext
CertDuplicateCertificateChain
CertGetCertificateContextProperty
CertVerifyCertificateChainPolicy
CryptMsgClose
CertOpenStore
CryptMsgUpdate
CryptMsgOpenToDecode
CryptSignMessage
CryptVerifyDetachedMessageSignature
CryptUnprotectData
CryptProtectData
CryptDecodeObject
CertFindExtension
CertGetEnhancedKeyUsage
CertGetCertificateChain
CertCloseStore

credui

CredUIPromptForCredentialsW
CredUIParseUserNameW

secur32

LsaConnectUntrusted
GetUserNameExW
FreeContextBuffer
QuerySecurityPackageInfoW
LsaLookupAuthenticationPackage
LsaDeregisterLogonProcess

cryptui

CryptUIDlgViewCertificateW

ntdll

RtlInitString
NtOpenFile
RtlInitUnicodeString
RtlInitializeCriticalSection
RtlUnwind

winhttp

WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpSendRequest
WinHttpQueryOption
WinHttpCloseHandle

winmm

timeGetTime
timeKillEvent
timeSetEvent

netapi32

NetGetJoinInformation
NetApiBufferFree

Sections

.text
Size: 383KB - Virtual size: 382KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 593KB - Virtual size: 593KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

65550315363f99ae3d270083b87eb80e

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ole32

oleaut32

shell32

comctl32

comdlg32

shlwapi

crypt32

credui

secur32

cryptui

ntdll

winhttp

winmm

netapi32

Sections

.text Size: 383KB - Virtual size: 382KB

.data Size: 4KB - Virtual size: 8KB

.rsrc Size: 593KB - Virtual size: 593KB

.reloc Size: 27KB - Virtual size: 27KB

.text
Size: 383KB - Virtual size: 382KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 593KB - Virtual size: 593KB

.reloc
Size: 27KB - Virtual size: 27KB