NEAS[.]02cc5b6bde73f680a2700e198692edb0_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.02cc5b6bde73f680a2700e198692edb0_JC.exe
Size

2.5MB
MD5

02cc5b6bde73f680a2700e198692edb0
SHA1

186c3ecc471b05b9ec8532f99282f8fca513e135
SHA256

d1bcc81b434c2337f88fe39b3d7625d3281436db37f3da4454c018e9eeea426f
SHA512

c0a08eca669df8bd6bedca9350f42a2ef23108e3776001066ed76ac60cea41c40d3517c30df711ba2e088743e3faafa166c4d55e3f9be4ce483f1d0fc11d3fec
SSDEEP

49152:AnzRB1SOBkrsCX/sndqqVG8WRwSEHbeaAxUf2QEr+xMvm1qNBUndU:Ar1X6rX0lVG/OL7IdLm1q2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.02cc5b6bde73f680a2700e198692edb0_JC.exe

Files

NEAS.02cc5b6bde73f680a2700e198692edb0_JC.exe
.exe windows:4 windows x86

cfea009918b3422d5242be7b93d73c4d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

rasapi32

RasHangUpA

winmm

midiStreamOut

ws2_32

WSAAsyncSelect

user32

GetClassNameA

gdi32

GetMapMode

winspool.drv

ClosePrinter

advapi32

RegCreateKeyExA

shell32

ShellExecuteA

ole32

StgCreateDocfileOnILockBytes

oleaut32

SafeArrayUnaccessData

comctl32

ImageList_Destroy

oledlg

ord8

wininet

InternetCanonicalizeUrlA

comdlg32

ChooseColorA

Sections

.text
Size: 2.4MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE