NEAS[.]0b3dc40268dd9f554233380afbdcbe50_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.0b3dc40268dd9f554233380afbdcbe50_JC.exe
Size

66KB
MD5

0b3dc40268dd9f554233380afbdcbe50
SHA1

8e8c1a2c06c672ffa2de6cc3a72a339cf805fcee
SHA256

cc9e6ffcb2dc8727bc5ca216a5811ab4f0e407fca3a0df4c7b3a271f8586bf8f
SHA512

b3454d2dd6c16f506a6584807ef097e0eb2b397fe47b06f9636c062618c372cb585a8a911833937b1236d5acbfbe9a4494b953abde5298575820cede19807dde
SSDEEP

1536:jJgULnil3f5Fjoxrks7T9fLx/oeXBcDVhc:jhk5FjoKsVhv6D7c

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.0b3dc40268dd9f554233380afbdcbe50_JC.exe

Files

NEAS.0b3dc40268dd9f554233380afbdcbe50_JC.exe
.exe windows:4 windows x86

1e0610984daf8229cfb3fe6aacc576a8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetConsoleCtrlHandler
UpdateResourceW
WaitNamedPipeW
Module32FirstW
RegEnumValueA
LZCopy
K32GetProcessImageFileNameA
GetNextVDMCommand
GetFullPathNameW
K32GetModuleBaseNameW
GetPackagePath

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE