NEAS[.]0f167314731d6c40fa53f5e484e7b2a0_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.0f167314731d6c40fa53f5e484e7b2a0_JC.exe
Size

147KB
MD5

0f167314731d6c40fa53f5e484e7b2a0
SHA1

ad1ddad6fee8cace418935445f85c6e88ac56d5d
SHA256

d0d784c5b5d78c31971a0b70721a4776dcd22a91789e863b3b3b380e9fd883cb
SHA512

45940ed020a0dc6ae9aa2ae5652944825535fae7bf246b1aac5886466a27f863864ad226bc217157cbfefe7d2f0107379606d46155dfd3c22241b58ed35c6da1
SSDEEP

3072:KqsCkle65wOeMHmKhcMxPXdZQYFVGo0kRwfj:LsCkT5uMHLxXj0F

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.0f167314731d6c40fa53f5e484e7b2a0_JC.exe

Files

NEAS.0f167314731d6c40fa53f5e484e7b2a0_JC.exe
.dll windows:5 windows x86

767f92df2cc6097f9e14b31a7ae17676

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

bsearch
_except_handler3
wcscpy
wcslen
wcsncpy
_wcsicmp
wcschr
swscanf
_wtol
wcscmp
wcstoul
_itow
swprintf
wcscat
_adjust_fdiv
malloc
_initterm
free
qsort
_wcsnicmp
wcsstr
wcsrchr
wcsncat
iswdigit
_wtoi

ntdll

RtlInitUnicodeString

netapi32

NetWkstaGetInfo
NetApiBufferFree

wldap32

ord13
ord10
ord41
ord36
ord167
ord224
ord79
ord18
ord203
ord194
ord16
ord206
ord134
ord135
ord138
ord191
ord116
ord100
ord173
ord319
ord321
ord179
ord91
ord88
ord145
ord219
ord210
ord208
ord54
ord157
ord155
ord165
ord188
ord161
ord69
ord65
ord113
ord111
ord85
ord40
ord26
ord27
ord127
ord97
ord140
ord77
ord142
ord133
ord73
ord216
ord29
ord53
ord300
ord311
ord301
ord94
ord12
ord120
ord147
ord146
ord304
ord310
ord190
ord309
ord14

advapi32

RegCreateKeyExW
OpenThreadToken
OpenProcessToken
LsaFreeMemory
LsaGetUserName
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
GetTokenInformation
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
IsValidSid
GetSidLengthRequired
SystemFunction040
SystemFunction041
RegSetValueExW

user32

LoadStringW
wsprintfW

kernel32

MultiByteToWideChar
InitializeCriticalSection
FreeLibrary
DeleteCriticalSection
CompareStringW
GetProcAddress
LoadLibraryW
GetLastError
GetCurrentThread
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
LocalFree
LocalAlloc
GetCurrentProcessId
GetCurrentProcess
CloseHandle
GetTickCount
FileTimeToSystemTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
ReadFile
GetFileSize
CreateFileW
WriteFile
DeleteFileW
CreateDirectoryW
ExpandEnvironmentStringsW
lstrlenW
CompareFileTime
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError

Exports

Exports

??0CLexer@@QAE@PAG@Z
??1CLexer@@QAE@XZ
?GetNextToken@CLexer@@QAEJPAGPAK@Z
?SetAtDisabler@CLexer@@QAEXH@Z
?SetExclaimnationDisabler@CLexer@@QAEXH@Z
?SetFSlashDisabler@CLexer@@QAEXH@Z
ADSIAbandonSearch
ADSICloseDSObject
ADSICloseSearchHandle
ADSICreateDSObject
ADSIDeleteDSObject
ADSIExecuteSearch
ADSIFreeColumn
ADSIGetColumn
ADSIGetFirstRow
ADSIGetNextColumnName
ADSIGetNextRow
ADSIGetObjectAttributes
ADSIGetPreviousRow
ADSIModifyRdn
ADSIOpenDSObject
ADSISetObjectAttributes
ADSISetSearchPreference
ADsAbandonSearch
ADsCloseSearchHandle
ADsCreateAttributeDefinition
ADsCreateClassDefinition
ADsCreateDSObject
ADsCreateDSObjectExt
ADsDecodeBinaryData
ADsDeleteAttributeDefinition
ADsDeleteClassDefinition
ADsDeleteDSObject
ADsEncodeBinaryData
ADsEnumAttributes
ADsEnumClasses
ADsExecuteSearch
ADsFreeColumn
ADsGetColumn
ADsGetFirstRow
ADsGetLastError
ADsGetNextColumnName
ADsGetNextRow
ADsGetObjectAttributes
ADsGetPreviousRow
ADsHelperGetCurrentRowMessage
ADsObject
ADsSetLastError
ADsSetObjectAttributes
ADsSetSearchPreference
ADsWriteAttributeDefinition
ADsWriteClassDefinition
AdsTypeFreeAdsObjects
AdsTypeToLdapTypeCopyConstruct
AdsTypeToLdapTypeCopyDNWithBinary
AdsTypeToLdapTypeCopyDNWithString
AdsTypeToLdapTypeCopyGeneralizedTime
AdsTypeToLdapTypeCopyTime
AllocADsMem
AllocADsStr
BerBvFree
BuildADsParentPath
BuildADsParentPathFromObjectInfo
BuildADsParentPathFromObjectInfo2
BuildADsPathFromLDAPPath
BuildADsPathFromLDAPPath2
BuildADsPathFromParent
BuildLDAPPathFromADsPath
BuildLDAPPathFromADsPath2
ChangeSeparator
Component
ConvertSidToString
ConvertSidToU2Trustee
ConvertU2TrusteeToSid
FindEntryInSearchTable
FindSearchTableIndex
FreeADsMem
FreeADsStr
FreeObjectInfo
GetDefaultServer
GetDisplayName
GetDomainDNSNameForDomain
GetLDAPTypeName
GetSyntaxOfAttribute
InitObjectInfo
IsGCNamespace
LdapAddExtS
LdapAddS
LdapAttributeFree
LdapCacheAddRef
LdapCloseObject
LdapCompareExt
LdapControlFree
LdapControlsFree
LdapCountEntries
LdapCrackUserDNtoNTLMUser
LdapCrackUserDNtoNTLMUser2
LdapCreatePageControl
LdapDeleteExtS
LdapDeleteS
LdapFirstAttribute
LdapFirstEntry
LdapGetDn
LdapGetNextPageS
LdapGetSchemaObjectCount
LdapGetSubSchemaSubEntryPath
LdapGetSyntaxIdOfAttribute
LdapGetSyntaxOfAttributeOnServer
LdapGetValues
LdapGetValuesLen
LdapInitializeSearchPreferences
LdapIsClassNameValidOnServer
LdapMakeSchemaCacheObsolete
LdapMemFree
LdapModDnS
LdapModifyExtS
LdapModifyS
LdapMsgFree
LdapNextAttribute
LdapNextEntry
LdapOpenObject
LdapOpenObject2
LdapParsePageControl
LdapParseResult
LdapReadAttribute
LdapReadAttribute2
LdapReadAttributeFast
LdapRenameExtS
LdapResult
LdapSearch
LdapSearchAbandonPage
LdapSearchExtS
LdapSearchInitPage
LdapSearchS
LdapSearchST
LdapTypeBinaryToString
LdapTypeCopyConstruct
LdapTypeFreeLdapModList
LdapTypeFreeLdapModObject
LdapTypeFreeLdapObjects
LdapTypeToAdsTypeCopyConstruct
LdapTypeToAdsTypeDNWithBinary
LdapTypeToAdsTypeDNWithString
LdapTypeToAdsTypeGeneralizedTime
LdapTypeToAdsTypeUTCTime
LdapValueFree
LdapValueFreeLen
LdapcKeepHandleAround
LdapcSetStickyServer
MapADSTypeToLDAPType
MapLDAPTypeToADSType
PathName
ReadPagingSupportedAttr
ReadSecurityDescriptorControlType
ReadServerSupportsIsADControl
ReallocADsMem
ReallocADsStr
SchemaAddRef
SchemaClose
SchemaGetClassInfo
SchemaGetClassInfoByIndex
SchemaGetObjectCount
SchemaGetPropertyInfo
SchemaGetPropertyInfoByIndex
SchemaGetStringsFromStringTable
SchemaGetSyntaxOfAttribute
SchemaIsClassAContainer
SchemaOpen
SortAndRemoveDuplicateOIDs
UnMarshallLDAPToLDAPSynID
intcmp

Sections

.text
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

767f92df2cc6097f9e14b31a7ae17676

Headers

File Characteristics

Imports

msvcrt

ntdll

netapi32

wldap32

advapi32

user32

kernel32

Exports

Exports

Sections

.text Size: 132KB - Virtual size: 131KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 132KB - Virtual size: 131KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB