NEAS[.]0dad599d50e64bc0860d9c24d69297f0_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.0dad599d50e64bc0860d9c24d69297f0_JC.exe
Size

354KB
MD5

0dad599d50e64bc0860d9c24d69297f0
SHA1

fff755daee26154c35f5640705bea23a5204cd31
SHA256

527e1b3a6c4fa4ceb9bef682abc7c525847fc0d3d80bc92142dbf40d8ebea72f
SHA512

71a63c02df6ab54e97bf249b6d4dfff59ee5a5b3e85c9fa0fec7199f025b6ae3a9aef2aea6f7e93214f0f8552e2ac40dfb862b1762c615ce973eb43afae56962
SSDEEP

6144:66LKgZ9lwq1pRj4Vscp9oTzpyspalchudQU3RWsqhX1zY/JCNbkdM:6Tq1poDp9QyscKkNo9Y/bdM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.0dad599d50e64bc0860d9c24d69297f0_JC.exe

Files

NEAS.0dad599d50e64bc0860d9c24d69297f0_JC.exe
.exe windows:6 windows x86

759486ab43cb52df3577d6a2b8b7ceca

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

dbghelp

ImageNtHeader
MiniDumpWriteDump

rpcrt4

RpcStringFreeW
UuidCreate
UuidToStringW
UuidFromStringW

iphlpapi

GetExtendedTcpTable

ws2_32

ntohs

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

shlwapi

StrCmpIW
PathFindExtensionW
PathFindFileNameW

kernel32

CreateFileW
GetFileAttributesW
GetCurrentThreadId
GetVersionExW
ReleaseMutex
SuspendThread
ResumeThread
OpenProcess
CreateToolhelp32Snapshot
CreateEventW
GetExitCodeThread
Sleep
FormatMessageW
GetLastError
SetEvent
DeleteFileW
CloseHandle
K32GetModuleBaseNameA
GetSystemInfo
K32GetModuleInformation
CreateThread
GetProcAddress
VirtualAllocEx
GetFileSize
ExitProcess
ReadProcessMemory
GetComputerNameW
GetCurrentProcessId
GetModuleHandleW
FreeLibrary
SleepEx
CreateRemoteThread
QueryFullProcessImageNameW
K32EnumProcessModules
VirtualFreeEx
K32GetMappedFileNameW
DebugBreak
MoveFileW
CreateMutexW
OpenThread
LoadLibraryExW
FlushFileBuffers
GetExitCodeProcess
RaiseException
WaitForSingleObject
LeaveCriticalSection
Thread32Next
InitializeCriticalSectionAndSpinCount
K32GetModuleFileNameExW
GetModuleFileNameW
VirtualAlloc
WriteFile
GetCurrentProcess
FindNextFileW
VirtualFree
EnterCriticalSection
WriteProcessMemory
FindFirstFileW
SetConsoleCtrlHandler
ReadFile
CreateDirectoryW
FindClose
VirtualProtect
LoadLibraryExA
HeapAlloc
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
QueryPerformanceCounter
GetPrivateProfileStringW
ExpandEnvironmentStringsW
SetLastError
GetSystemTimeAsFileTime
GetProcessHeap
InitializeSListHead
SetFilePointer
Thread32First
CompareStringW
HeapReAlloc
GetEnvironmentVariableW
SetEnvironmentVariableW
lstrlenW
VirtualQuery

advapi32

LookupPrivilegeValueW
RegisterServiceCtrlHandlerExW
AdjustTokenPrivileges
RegCloseKey
CloseServiceHandle
OpenSCManagerW
SetServiceStatus
OpenProcessToken
StartServiceW
RegOpenKeyExW
StartServiceCtrlDispatcherW
OpenServiceW
QueryServiceStatusEx
RegQueryValueExW
EventRegister
EventUnregister
EventWriteString

vcruntime140

__std_exception_copy
__CxxFrameHandler3
wcsrchr
__std_exception_destroy
wcschr
memset
_CxxThrowException
_except_handler4_common
memcpy

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfwprintf
__stdio_common_vswscanf
__acrt_iob_func
_set_fmode
__p__commode
__stdio_common_vswprintf

api-ms-win-crt-string-l1-1-0

wcsnlen
_wcsicmp
_stricmp
_wcsnicmp
wcsncmp

api-ms-win-crt-runtime-l1-1-0

_configure_wide_argv
_cexit
_crt_atexit
_seh_filter_exe
_exit
_register_onexit_function
_initialize_onexit_table
_initialize_wide_environment
_get_initial_wide_environment
_controlfp_s
_errno
terminate
_initterm_e
_initterm
_register_thread_local_exe_atexit_callback
__p___wargv
_c_exit
_set_app_type
exit
__p___argc

api-ms-win-crt-time-l1-1-0

_time64
_wstrdate_s
_gmtime64_s
_wstrtime_s

api-ms-win-crt-filesystem-l1-1-0

_wmakepath_s
_wremove
_wsplitpath_s

api-ms-win-crt-convert-l1-1-0

wcstoul
_wtoi

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc
_set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 231KB - Virtual size: 232KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

759486ab43cb52df3577d6a2b8b7ceca

Headers

DLL Characteristics

File Characteristics

Imports

dbghelp

rpcrt4

iphlpapi

ws2_32

version

shlwapi

kernel32

advapi32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 57KB - Virtual size: 57KB

.rdata Size: 43KB - Virtual size: 43KB

.data Size: 19KB - Virtual size: 148KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 231KB - Virtual size: 232KB

.text
Size: 57KB - Virtual size: 57KB

.rdata
Size: 43KB - Virtual size: 43KB

.data
Size: 19KB - Virtual size: 148KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 231KB - Virtual size: 232KB