NEAS[.]14fee4064202682eb745f869d47f0950_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.14fee4064202682eb745f869d47f0950_JC.exe
Size

5KB
MD5

14fee4064202682eb745f869d47f0950
SHA1

52778ff1d424b2a9a096c02a30009242905216c7
SHA256

47d28241654efbeb8dabfebcc4eaa4ab63ef7a7c33af2a7e786d4efaceef358c
SHA512

8b98c5270b64504ecc8ba8a4de1e7ba3ce3dcc4eef377da865a542a5b64ad99a8ed50a3b1d0fdde83833202772da64d2c0c54e4447ab82c1abdba03de0a0b8ba
SSDEEP

48:6YsetHxWXPIR/4lv8W4dkpvw53zuEYJWTON+Trg7zARTGRTW9orw04r:HdtHwXPIJ4lv8ScDoJWTOMTrU4Kior

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.14fee4064202682eb745f869d47f0950_JC.exe

Files

NEAS.14fee4064202682eb745f869d47f0950_JC.exe
.exe windows:4 windows x64

4f1b525553e03bd1c338c35cab87fa0a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

LocalAlloc
GetSystemTime
Sleep
ExpandEnvironmentStringsA

msvcrt

memmove
printf
system
_vsnprintf
__set_app_type
_controlfp
__argc
__argv
_environ
__getmainargs
exit

urlmon

URLDownloadToFileA

snmpapi

SnmpUtilOidCpy
SnmpUtilOidFree
SnmpUtilPrintOid
SnmpUtilPrintAsnAny
SnmpUtilMemReAlloc
SnmpUtilVarBindFree
SnmpUtilIdsToA

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ