NEAS[.]0c96cf4a44e7920aa4cc6720717705e0_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.0c96cf4a44e7920aa4cc6720717705e0_JC.exe
Size

53KB
MD5

0c96cf4a44e7920aa4cc6720717705e0
SHA1

07faaa299bfa8f2acb2a4a8178f42ca22bec4e7f
SHA256

d0eae5fff1416d6e093ced4ae079ff291cb49f71a77846ff0faac6921d423e5f
SHA512

111b2918b4bcdad9452d1250df3d2e3b80e731b12b2dede255cfcf03dc8be24ef84a24c3f5e1a862d902118ae5c09114c72fd8dc79878d12f130c4d9e33b6385
SSDEEP

1536:vMcQYte55zs091Zw9FAGDdJYipvwGf9ogjrg1P:vMhAe5Zs091KI+JYixw49Xjr2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.0c96cf4a44e7920aa4cc6720717705e0_JC.exe

Files

NEAS.0c96cf4a44e7920aa4cc6720717705e0_JC.exe
.exe windows:5 windows x86

b892955ae494fe908bdf52e81e1dfa4c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetProcAddress
VirtualAlloc
VirtualFree
VirtualProtect

user32

EndPaint

advapi32

RegCloseKey

shell32

ShellExecuteA

ws2_32

WSAStartup

iphlpapi

GetAdaptersAddresses

Sections

.text
Size: 35KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 7KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

IOSDWD
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE