NEAS[.]05b5c28de6af8565b4d32e155343c1b0_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.05b5c28de6af8565b4d32e155343c1b0_JC.exe
Size

63KB
MD5

05b5c28de6af8565b4d32e155343c1b0
SHA1

378112b8004b0b38c32da986e3ea2c3785ac7adb
SHA256

a0d32e035529b8b20ba75c61a4b76401cb56d6f15143d60d4ddeabdc6b613d61
SHA512

66dce70ab052deeabd2760098663995792d14ca6a88e7f026665fcc95ce009ee82f1035b1493c053f9abb99d2051c31df6768a83ed02a10bcf3001e95d103edd
SSDEEP

1536:XqJl8UHHFvkcvg9zELsRAC+n14fdYslkWf:Ev9RFLIAC+n1lslZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.05b5c28de6af8565b4d32e155343c1b0_JC.exe

Files

NEAS.05b5c28de6af8565b4d32e155343c1b0_JC.exe
.exe windows:4 windows x86

d3dead7372ac683adb9217d163a59742

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RtlZeroMemory
CreateNamedPipeW
AddConsoleAliasA
OpenFileMappingW
RtlCaptureStackBackTrace
FillConsoleOutputCharacterA
FindFirstVolumeW
GetLogicalDrives
GetProfileSectionW
QueryWin31IniFilesMappedToRegistry

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 49KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE