NEAS[.]0bbdae1b81b320ebaa8bb5a6579ab390_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.0bbdae1b81b320ebaa8bb5a6579ab390_JC.exe
Size

79KB
MD5

0bbdae1b81b320ebaa8bb5a6579ab390
SHA1

6e46b4c2c06bf3a687f1977058a9f2f6e67b6eef
SHA256

926fc57a10b584b9a669ab40a4b0eb2b9e68667d54155005f5126267613f2afe
SHA512

b8f77baae14abc3948223bfb5d3ea94b4746932cfdc528f012dd0b39973eeaf78f0769b84b81a099374f137f133b3d9ad5594ab96e3271acdb7e54594edeb2c6
SSDEEP

1536:Wzq+5hRpv07ANZBywCfqOScvlI1+07yqkHMAdwHbqHZjKk0t6Q6osa8IFxm6tH:INZ8w2qzcNN0/kH/dwHbKRh0t65v6d

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.0bbdae1b81b320ebaa8bb5a6579ab390_JC.exe

Files

NEAS.0bbdae1b81b320ebaa8bb5a6579ab390_JC.exe
.exe windows:4 windows x86

623e029b859aa50298b524aa0f33cb1f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memset
strcmp
memmove
memcpy
strlen

kernel32

GetModuleHandleA
HeapCreate
HeapDestroy
ExitProcess
CloseHandle
InitializeCriticalSection
GetModuleFileNameA
HeapFree
HeapReAlloc
HeapAlloc
CreateFileA
ReadFile

user32

MessageBoxA

wsock32

closesocket
WSACleanup
WSAStartup

Sections

.code
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE