NEAS[.]0ca370b04b852917c8d370c1238f8d80_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.0ca370b04b852917c8d370c1238f8d80_JC.exe
Size

84KB
MD5

0ca370b04b852917c8d370c1238f8d80
SHA1

3803a7738468c146da3cdebf9b888ddc81dab86c
SHA256

0db6bed0e4e11486f4ee9ebbe58c7f8ba5a959e999a7f1a60dba50c1fa471473
SHA512

d0733a0cfc438d380a98fb4cef921a9e9add312da710c402eb055d40fb92eac8889dad01e3f0485c1f16ef82977345435c3a3ae58a0814e160f295ded883a96b
SSDEEP

768:A3ncJu5hBXF2pmiq2V41xNmAFgGyi4XwP13GT9W28z/zMp5xAFiE3s:A3cJu5hBVWq2kN6LXwPVGT9lgA5gs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.0ca370b04b852917c8d370c1238f8d80_JC.exe

Files

NEAS.0ca370b04b852917c8d370c1238f8d80_JC.exe
.exe windows:4 windows x86

af7bbc720f4103a2065171def931dc1a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord6374
ord4299
ord2379
ord4710
ord4287
ord4234
ord324
ord1168
ord1146
ord3597
ord4425
ord4627
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5280
ord4353
ord5163
ord2385
ord5241
ord4407
ord1775
ord825
ord4078
ord6052
ord4998
ord5265
ord823
ord2514
ord641
ord561
ord815
ord3738
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord4079
ord2725
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord4673
ord1576

msvcrt

__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
_onexit
_adjust_fdiv
_strdup
_mbscmp
_mbstok
memmove
srand
rand
wcscpy
_setmbcp
__p__commode
__p__fmode
__set_app_type
__dllonexit
exit
_mbsstr
_mbsrev
_mbsnbcpy
_mbsnbcat
_splitpath
swprintf
wcsrchr
wcscmp
_mbsnbicmp
_mbsicmp
_mbsupr
wcschr
_mbslwr
malloc
free
__CxxFrameHandler
_mbsrchr
sprintf
_access
_except_handler3
_vsnprintf
fopen
fprintf
_mbslen
fclose
_mbschr
_controlfp

kernel32

CreateFileA
GetCurrentProcessId
GetLocalTime
GetModuleHandleA
OutputDebugStringA
GetPrivateProfileSectionA
GetPrivateProfileSectionNamesA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetModuleFileNameA
TerminateProcess
DuplicateHandle
GetCurrentProcess
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrcpynA
GetLastError
FormatMessageA
LocalFree
SetLastError
OpenProcess
WaitForSingleObject
CreateThread
GetCurrentThreadId
Sleep
GetProcessHeap
Process32Next
Process32First
LockResource
SizeofResource
LoadResource
FindResourceA
WriteFile
GetTempFileNameA
GetTempPathA
CreateFileMappingA
OpenFileMappingA
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ReleaseMutex
WideCharToMultiByte
GetStartupInfoA
WriteProcessMemory
GetProcAddress
LoadLibraryA
GetTickCount
SetUnhandledExceptionFilter
FreeLibrary
VirtualAllocEx
VirtualFreeEx
ReadProcessMemory
CreateProcessA
GetVersionExA
CreateMutexA
LoadLibraryExA
MapViewOfFile
UnmapViewOfFile
LocalAlloc
ResumeThread
GetWindowsDirectoryA
SetFileAttributesA
SetPriorityClass
GetShortPathNameA
GetEnvironmentVariableA
Module32First
CreateToolhelp32Snapshot
ExpandEnvironmentStringsA
HeapFree
CloseHandle
HeapAlloc

user32

EnableWindow
wsprintfA
PostMessageA
GetWindowThreadProcessId
SendMessageA
GetWindowLongA
SetWindowLongA
SetTimer
LoadIconA
ClientToScreen
FindWindowExA

advapi32

AllocateAndInitializeSid
AdjustTokenPrivileges
LookupPrivilegeValueA
GetTokenInformation
GetSecurityInfo
FreeSid
AddAccessAllowedAce
AddAccessDeniedAce
InitializeAcl
LookupAccountSidA
RegDeleteValueA
RegEnumKeyExA
SetNamedSecurityInfoA
BuildExplicitAccessWithNameA
GetNamedSecurityInfoA
SetSecurityDescriptorDacl
GetLengthSid
InitializeSecurityDescriptor
SetSecurityInfo
OpenProcessToken
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
SetEntriesInAclA

shell32

SHGetSpecialFolderPathW
SHGetDesktopFolder
SHGetDataFromIDListW
SHGetSpecialFolderLocation
ShellExecuteA
SHGetPathFromIDListA

ole32

CoUninitialize
CoInitializeEx
CoCreateInstance

msvcp60

??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ

dbghelp

MiniDumpWriteDump

wininet

DeleteUrlCacheEntry

shlwapi

PathUnquoteSpacesA
SHDeleteKeyA
PathRemoveArgsA

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

af7bbc720f4103a2065171def931dc1a

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

advapi32

shell32

ole32

msvcp60

dbghelp

wininet

shlwapi

Sections

.text Size: 40KB - Virtual size: 39KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 8KB - Virtual size: 89KB

.rsrc Size: 20KB - Virtual size: 16KB

.text
Size: 40KB - Virtual size: 39KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 8KB - Virtual size: 89KB

.rsrc
Size: 20KB - Virtual size: 16KB