NEAS[.]10ca6ab9e50899755e205355c18f5890_JC[.]exe | Triage

Sharing

General

Target

NEAS.10ca6ab9e50899755e205355c18f5890_JC.exe
Size

66KB
MD5

10ca6ab9e50899755e205355c18f5890
SHA1

dc0a4adf61b32700dd119a3393ce66f2f276c8b3
SHA256

0ea0287f5293114b35dfd7705dab047df001b443a91e42d3989826dcbf981290
SHA512

da936331688d4855b32e2223a83732bf7418d572386d5a9251ea6deb16edcd0cee94ff4b1eb91597c78d8146c9250a52707c68ace69f2e13f55f5e456c9287b5
SSDEEP

1536:K86/AyYCgx0NJ1uiB9x7qoWEEVSTR5hShHzzc0cYfY6fplLDcAU:Kx/BEyNaiB7UE/BSZv7cYwGDD7U

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.10ca6ab9e50899755e205355c18f5890_JC.exe

Files

NEAS.10ca6ab9e50899755e205355c18f5890_JC.exe
.exe windows:4 windows x86

c664ccf645b11db49a7011370b59da5c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RegQueryValueExA
SetConsoleMaximumWindowSize
GetFileSize
CreateProcessAsUserA
GetThreadUILanguage
SetEndOfFile
EnumSystemLocalesW
ApplicationRecoveryInProgress
lstrcat
NtVdm64CreateProcessInternalW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE