NEAS[.]037b5bbdff45a9720c30239f2aec3dd0_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.037b5bbdff45a9720c30239f2aec3dd0_JC.exe
Size

377KB
MD5

037b5bbdff45a9720c30239f2aec3dd0
SHA1

a0abbd38808c46ab3cac5008e15c18a99d0b82cb
SHA256

4d648bede632826aec5af60df0e3336e53632e488eb47904d2ba9f58185bfa62
SHA512

096444b67e4f2a87eda9dbd8934bb44e4bdd9c97f19d1685be1f35997a905623b0196cf75fcd30ebf359055d012a74a23fe24c62419020b1103a34b1c8bbfb31
SSDEEP

6144:+fOXLUPschWADw9Ex0EGsbrRoXhy2b6GVJyB60OHyLC7vj1rpX8U:+G7UPscWAbq6d2Y2b9c2Hywr1r

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.037b5bbdff45a9720c30239f2aec3dd0_JC.exe

Files

NEAS.037b5bbdff45a9720c30239f2aec3dd0_JC.exe
.exe windows:6 windows x86

69cf6cd3d00b59a74008ea803488a533

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
MD5Init
MD5Update
MD5Final
RegSetKeyValueW
EventRegister
EventWrite
EventUnregister
ConvertSidToStringSidW
GetSidSubAuthorityCount
GetSidSubAuthority
EqualSid
RegisterWaitChainCOMCallback
OpenThreadWaitChainSession
GetThreadWaitChain
CloseThreadWaitChainSession
GetKernelObjectSecurity
GetSecurityDescriptorDacl
OpenThreadToken
SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetKernelObjectSecurity
GetTokenInformation
IsValidSid
GetLengthSid
CopySid
DuplicateToken
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
StopTraceW
QueryTraceW
StartTraceW
EnableTrace
RegOpenKeyW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
RegDeleteKeyW
CreateProcessAsUserW
OpenProcessToken

kernel32

CreateProcessW
GetModuleFileNameW
RegEnumKeyExW
DeleteFileW
RegEnumValueW
FileTimeToSystemTime
WriteFile
GetFileAttributesExW
FindClose
FindNextFileW
FindFirstFileW
CreateFileW
RegGetValueW
RegQueryValueExW
GetSystemDefaultLangID
GetProductInfo
GetSystemInfo
LocalFree
MoveFileExW
SetFileAttributesW
GetDiskFreeSpaceExW
ReadFile
GetLocalTime
CreateDirectoryW
SetPriorityClass
OpenProcess
DeviceIoControl
GetFileAttributesW
ReadProcessMemory
LoadLibraryW
SystemTimeToFileTime
GetSystemTime
FreeLibraryAndExitThread
GetExitCodeThread
CreateThread
GetModuleHandleExW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
HeapFree
HeapAlloc
GetProcessHeap
OpenFileMappingW
DuplicateHandle
LoadLibraryExW
QueryFullProcessImageNameW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetThreadUILanguage
GetNativeSystemInfo
SearchPathW
IsWow64Process
GetSystemDirectoryW
GetUserDefaultUILanguage
GetProcessTimes
GetApplicationRestartSettings
MultiByteToWideChar
lstrlenW
FormatMessageW
GetWindowsDirectoryW
GetSystemWow64DirectoryW
GetFileSize
ExpandEnvironmentStringsW
WaitForMultipleObjects
GetFileInformationByHandle
GetFinalPathNameByHandleW
SetFileInformationByHandle
GetLongPathNameW
GetTempPathW
GetTempFileNameW
GetFileSizeEx
CheckRemoteDebuggerPresent
RegQueryInfoKeyW
VirtualQuery
SetEvent
GetPriorityClass
GetModuleHandleW
SetEnvironmentVariableW
CreateEventW
GetStringTypeExW
ResetEvent
K32GetModuleFileNameExW
Thread32Next
OpenThread
Thread32First
InitializeCriticalSection
SetThreadpoolWait
EnterCriticalSection
LeaveCriticalSection
GetThreadContext
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
GetProcessId
DeleteCriticalSection
CreateThreadpoolWait
GetProcessIoCounters
GetThreadTimes
GetThreadId
GetProcessIdOfThread
LCMapStringW
OutputDebugStringA
VirtualFree
VirtualAlloc
InterlockedIncrement
InterlockedDecrement
OpenEventW
K32EnumProcessModules
GlobalMemoryStatus
Module32NextW
Module32FirstW
QueryDosDeviceW
GetLogicalDriveStringsW
GetDriveTypeW
FindNextFileNameW
FindFirstFileNameW
CompareFileTime
FindFirstFileExW
GetCurrentThread
GetThreadPriority
SetThreadPriority
WTSGetActiveConsoleSessionId
GetVersionExW
SetLastError
RegDeleteValueW
RegCloseKey
OpenMutexW
GetCommandLineW
CloseHandle
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
Sleep
InterlockedExchange
SetErrorMode
HeapSetInformation
WaitForSingleObject
GetProcAddress
InitializeCriticalSectionAndSpinCount
ReleaseMutex
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
CompareStringW
CreateMutexW
GetLastError
FreeLibrary
InterlockedCompareExchange
LoadLibraryExA
DelayLoadFailureHook

user32

GetProcessWindowStation
LoadStringW
DispatchMessageW
TranslateMessage
IsHungAppWindow
GetClassNameW
GetWindow
IsWindowEnabled
GetWindowThreadProcessId
SendMessageW
SetWindowPos
GetWindowLongW
GetThreadDesktop
EnumWindows
MonitorFromPoint
GetSystemMetrics
LogicalToPhysicalPoint
GetMonitorInfoW
MonitorFromWindow
IsIconic
GetWindowRect
SetWindowLongW
EndDialog
PostMessageW
LoadIconW
DefWindowProcW
RegisterErrorReportingDialog
CheckWindowThreadDesktop
IsWindow
GetUserObjectInformationW
GetMessageW
RegisterWindowMessageW
ShowWindow
CreateWindowExW
RegisterClassExW
ChangeWindowMessageFilter

msvcrt

iswspace
wcspbrk
_CxxThrowException
memcpy
wcsstr
_wcstoui64
_purecall
_vsnprintf
wcsncmp
_vscwprintf
tolower
towlower
??1type_info@@UAE@XZ
memmove
_wcsnicmp
_wtoi64
_exit
_XcptFilter
exit
_initterm
isspace
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_controlfp
__wgetmainargs
_vsnwprintf
__CxxFrameHandler3
wcschr
_wcsicmp
memset
??3@YAXPAX@Z
??2@YAPAXI@Z
wcsrchr
_wtoi
_unlock
__dllonexit
_lock
_onexit
_cexit

ntdll

RtlCreateProcessReflection
WinSqmAddToStream
WinSqmSetString
RtlFreeHeap
RtlAllocateHeap
NtSetSystemInformation
RtlAdjustPrivilege
NtQueryObject
NtSystemDebugControl
WinSqmIncrementDWORD
NtSuspendProcess
NtResumeProcess
NtQuerySystemInformation
RtlUpcaseUnicodeChar
RtlCompareMemory
ShipAssert
WinSqmEndSession
WinSqmStartSession
WinSqmSetDWORD
NtQueryInformationThread
NtQueryEvent
RtlImageNtHeaderEx
RtlAllocateAndInitializeSid
RtlInitUnicodeString
NtAlpcConnectPort
NtAlpcSendWaitReceivePort
RtlFreeSid
NtOpenEvent
NtWaitForSingleObject
NtClose
EtwEventWriteNoRegistration
RtlNtStatusToDosError
NtQueryInformationProcess
NtQueryInformationToken
EtwTraceMessage
DbgPrint

ole32

CoGetCallState
CoUninitialize
CoCreateInstance
CoInitialize
CoGetActivationState
CoGetObject
StringFromGUID2
CoSetProxyBlanket
CoTaskMemFree
ProgIDFromCLSID
CLSIDFromString
CoCreateGuid

oleaut32

SysAllocStringLen
SysFreeString

shlwapi

ord437

imm32

ImmDisableIME

wer

WerpAddAppCompatData
WerpReportCancel
WerReportCreate
WerpSetIntegratorReportId
WerpGetReportConsent
WerpSetCallBack
WerpAddRegisteredDataToReport
WerReportSetUIOption
WerReportSubmit
WerReportCloseHandle
WerpAddFile
WerpPromtUser
WerpAddSecondaryParameter
WerReportAddDump
WerpSetEventName
WerpSetDynamicParameter
WerReportSetParameter
WerpIsTransportAvailable
WerpGetReportFlags
WerpSetReportFlags
WerpGetNumFiles
WerpGetFileByIndex
WerpCreateIntegratorReportId
WerReportAddFile
WerpFreeString

comctl32

ord410
ord412
ord345
ord413

faultrep

WerpInitiateCrashReporting

Sections

.text
Size: 243KB - Virtual size: 243KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

hobcnof
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

69cf6cd3d00b59a74008ea803488a533

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

ntdll

ole32

oleaut32

shlwapi

imm32

wer

comctl32

faultrep

Sections

.text Size: 243KB - Virtual size: 243KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 85KB - Virtual size: 85KB

.reloc Size: 44KB - Virtual size: 44KB

hobcnof Size: - Virtual size: 4KB

.text
Size: 243KB - Virtual size: 243KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 85KB - Virtual size: 85KB

.reloc
Size: 44KB - Virtual size: 44KB

hobcnof
Size: - Virtual size: 4KB