NEAS[.]00deebeb4b9a09372c4c7ca021463300_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.00deebeb4b9a09372c4c7ca021463300_JC.exe
Size

101KB
MD5

00deebeb4b9a09372c4c7ca021463300
SHA1

aac47e135d5c94398367b61a5835585abe214082
SHA256

1dafe362a27b0cb0ba9b762daae400cbeefbde4263bc334c068afbd9c95ad204
SHA512

d2be8c6b41d461d111e1466fe1df559fc9ba83a64709fee5e17b70d6b1951ad79f3be79fbcf5d3f5ec937183ae98309fcda113b1d0c20d4e1d414d708c2b7b54
SSDEEP

1536:nufJG5bVxZAhEcT1yULhiAJ0CuQmcvhvMGJXrq4C9xGy:v5bcT8ULRygrXrqb9x

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.00deebeb4b9a09372c4c7ca021463300_JC.exe

Files

NEAS.00deebeb4b9a09372c4c7ca021463300_JC.exe
.exe windows:6 windows x86

67cbad80770a6a6cb9cdbaa0599d2663

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
EventRegister
EventUnregister
RegDeleteKeyValueW
RegGetValueW
RegSetKeyValueW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegEnumValueW
EventWrite

kernel32

GlobalAlloc
AcquireSRWLockShared
ReleaseSRWLockShared
GetComputerNameExW
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
ResetEvent
SubmitThreadpoolWork
CreateThreadpoolWork
GlobalFree
ReadFile
WriteFile
SetFilePointerEx
GetFileSizeEx
WaitForSingleObject
GetCurrentProcess
CreateFileW
InterlockedIncrement
InterlockedDecrement
SetEvent
CloseHandle
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeSRWLock
DuplicateHandle
GetTickCount
CreateEventW
CreateThreadpoolTimer
GetLastError
InterlockedExchange
MultiByteToWideChar
GetSystemFirmwareTable
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
Sleep
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange

user32

GetDisplayConfigBufferSizes
DisplayConfigGetDeviceInfo
QueryDisplayConfig

msvcrt

__set_app_type
free
_purecall
malloc
memset
qsort
_wcsnicmp
wcsstr
_wcsicmp
_vsnwprintf
__RTDynamicCast
wcschr
memcpy
_callnewh
__getmainargs
_cexit
_controlfp
_except_handler4_common
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_ismbblead
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_XcptFilter
_exit

ole32

CoAddRefServerProcess
CoReleaseServerProcess
CoUninitialize
CLSIDFromString
IIDFromString
StringFromIID
StringFromGUID2
CoTaskMemFree
CoTaskMemAlloc
PropVariantClear
CreateStreamOnHGlobal
CoCreateInstance
CoInitializeEx
CoRegisterClassObject
CoRevokeClassObject

devobj

DevObjGetDeviceProperty
DevObjOpenDeviceInfo
DevObjCreateDeviceInfoList
DevObjDestroyDeviceInfoList

propsys

PSPropertyKeyFromString

dmrc

DMrcQueryModelId
DMrcGetProperties
DMrcQueryClose
DMrcInit
DMrcExit
DMrcQueryHardwareId

xmllite

CreateXmlReader

bcrypt

BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptGetProperty
BCryptCreateHash
BCryptHashData

Sections

.text
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

67cbad80770a6a6cb9cdbaa0599d2663

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

ole32

devobj

propsys

dmrc

xmllite

bcrypt

Sections

.text Size: 75KB - Virtual size: 75KB

.data Size: 1KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 21KB - Virtual size: 24KB

.text
Size: 75KB - Virtual size: 75KB

.data
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 21KB - Virtual size: 24KB