NEAS[.]071ee4a7e0deab0368d8da34054f7800_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.071ee4a7e0deab0368d8da34054f7800_JC.exe
Size

18KB
MD5

071ee4a7e0deab0368d8da34054f7800
SHA1

639f4f144c178bee4385530f5dab0e1ba3e80530
SHA256

138766997c3a2de5e68734320e46923b78459a52e0f510545af161014632a583
SHA512

8f2075f2984d9d36881cf2e185a9b725d756b6500f17b550b4d6df36201f327b1c7cd239b3027eaed1d1f8f1e2ca0c184d668a51b04dc35c4648bb17c7fc1202
SSDEEP

384:znXR3O0S4aHmk11w+z3uc99AB2QwBpJ5SZnHo0vij+pU1K:zXNO0eRTT3ucTABk7JUZHdv+oqK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.071ee4a7e0deab0368d8da34054f7800_JC.exe

Files

NEAS.071ee4a7e0deab0368d8da34054f7800_JC.exe
.dll windows:4 windows x86

17b5e2fcb285d026e397d0418b2bb6fe

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileA
CreateProcessA
WriteFile
GetTempPathA
GetLocalTime
GetCPInfoExA
GetACP
MultiByteToWideChar
GetLastError
CreateThread
GetModuleFileNameA
DisableThreadLibraryCalls
VirtualAlloc
VirtualFree
GetSystemDirectoryA
DeleteFileA
Sleep
SetThreadPriority
CloseHandle
LoadLibraryA
TerminateThread
GetProcAddress

user32

DrawTextExW
CreatePopupMenu
CreateDesktopW
EnumThreadWindows

wininet

HttpQueryInfoA
InternetOpenUrlA
InternetOpenA
InternetReadFile
InternetCloseHandle

gdi32

GetBkColor

advapi32

DeleteService
OpenSCManagerA
CloseServiceHandle
ControlService
OpenServiceA

shell32

ShellExecuteExW

msvcrt

memcpy
memset
strcat
strcpy
sprintf
strrchr
strlen
_except_handler3

Exports

Exports

DriverProc
modMessage
modmCallback

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ