NEAS[.]0928ba691ccdd617eaebbdc374781470_JC[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.0928ba691ccdd617eaebbdc374781470_JC.exe
Size

527KB
MD5

0928ba691ccdd617eaebbdc374781470
SHA1

34134d57d53ef9d36e6f0ec087042bec9bc9650d
SHA256

9ae4e3ae497b8c6c50d42afb66772c0ab3f801b1948c042c022ef74985d51046
SHA512

3e7ba0b8ae7692ac975ea9b7894cd4f670676f9dfdd6704e3f96f532931b1980c8bf77a2bb9abc4acddfef99c63dfc94a43da89279193ec8ee742058ff403372
SSDEEP

6144:+bF+Xg/kB3jlSbByxxETztQohq8yW3omrm76KSyF5PNTmSt40hWceYB61AeYlSsU:+bFeQo3jlSb1QoEEy7y4T3tDWNQIIit

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.0928ba691ccdd617eaebbdc374781470_JC.exe

Files

NEAS.0928ba691ccdd617eaebbdc374781470_JC.exe
.dll regsvr32 windows:6 windows x64

f8fddac568dbbf6a9fc0cf05e2558170

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

FindClose
ReadFile
CloseHandle
GetProcessHeap
GetEnvironmentStringsW
GetUserDefaultLangID
UnregisterApplicationRecoveryCallback
GetCurrentThread
GetUserDefaultUILanguage
GetThreadUILanguage
GetErrorMode
GetCommandLineW
UnregisterApplicationRestart
GetCurrentThreadId
FlushProcessWriteBuffers
GetCommandLineA
TlsAlloc
SetFileApisToOEM
AreFileApisANSI
GetThreadErrorMode
GetACP
VirtualAlloc
GetLogicalDrives
GetCurrentProcess
GetLastError
IsDebuggerPresent
RaiseException
InitializeCriticalSectionEx
DeleteCriticalSection
DecodePointer
FindNextFileA
LoadResource
SizeofResource
FindResourceW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
GetModuleFileNameW
lstrcmpiW
FreeLibrary
FreeEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindFirstFileExA
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
ReadConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
HeapReAlloc
HeapSize
GetFileType
GetTickCount64
SetStdHandle
WriteConsoleW
CreateFileW
RtlUnwind
MultiByteToWideChar
GetStdHandle
HeapAlloc
HeapFree
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
TerminateProcess
TlsFree
TlsSetValue
TlsGetValue
InitializeCriticalSectionAndSpinCount
SetLastError
InterlockedFlushSList
RtlPcToFileHeader
RtlUnwindEx
OutputDebugStringW
GetCPInfo
GetStringTypeW
LCMapStringEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
EncodePointer

user32

IsProcessDPIAware
GetOpenClipboardWindow
GetClipboardViewer
GetProcessWindowStation
GetCursor
GetMessageExtraInfo
GetMenuCheckMarkDimensions
GetForegroundWindow
CreateMenu
CloseClipboard
GetShellWindow
GetCapture
GetKBCodePage
GetClipboardSequenceNumber
AnyPopup
GetMessageTime
CharNextW
GetDesktopWindow
GetFocus

gdi32

GdiFlush

advapi32

RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW

shell32

InitNetworkAddressControl

ole32

CoFreeUnusedLibraries
CoUninitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
OleUninitialize

oleaut32

VarUI4FromStr

Exports

Exports

DllMain
DllRegisterServer
DllUnregisterServer
EntryFunct
aidssolxs
ajqmazbjnt
bqrihojcjv
caxhtxwzzno
cpjlbwqsbj
cuabrqahl
cwldkycyzcvpzeeq
dbyjipcelxmg
dexobebpza
dggojrqgstfghhy
dswtdytgm
dyvkmsvsgupjnsan
evmhulfxnfcrhhysc
ffuricrj
fseorzt
fxdrkguymxdnddlmp
fydjjqspepx
giytwjddcdp
gwutwzacrshdj
gymjykefojqub
hflrlhium
hjzjuurh
hmhzznbcwdsrsizau
hyyxncdydmlcj
idphlxrfendt
ilainljdezeogdb
inkhcstpir
kqvxajqmnk
ktszrbjfug
lnzatvicjiq
lqfhdryfloyfkwwi
ltwhngxnfxs
mgvozkgpuzeedd
mlowsuo
mnrashmcmgimhcdku
ngwhdvm
nlvsbmqtnqsywlsdh
ocyjfgkwkeend
oghylpqki
osjxpvfvyfydy
pdzgqqa
phsigpj
pudduyw
pwdltpywrtyeibxr
pxkibxnl
qaoqfyll
qaxjxbqmse
qjzyhlxetqkecbhlg
qmbubnczhkq
qqsgptvljmjhgxa
qvrqwlhzujxz
rjckknmbqkc
rkkiralasfitltsd
sauwodtvwykqvs
scmzzdhfgega
shjqxiaegahkmsy
shkkigfhdr
siqggpzriioeml
swmomhikpe
sxzpwletneexgase
tqjqxqmmf
ugbtnwmzx
upbstohm
vwdqprqt
whizeahlfqozrvsa
whtmudvffl
wjdejpmzdsrrrnb
wjzroztdlih
wlyolprx
wmxvgecftgdkqv
wpzmlgb
wsnvzngxmvcjbgvlg
wtkiskewk
xcsoipoayfalke
xotpstpowszvltl
ycrsuizpmaghxgl
yjxyyohwopzos
ykokxdkaabhiiznbg
ykpdrojwxkgb
yyjddnthlbmrpt
zlhslerjcqqqm

Sections

.text
Size: 135KB - Virtual size: 135KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 298KB - Virtual size: 298KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f8fddac568dbbf6a9fc0cf05e2558170

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 135KB - Virtual size: 135KB

.rdata Size: 77KB - Virtual size: 76KB

.data Size: 4KB - Virtual size: 10KB

.pdata Size: 7KB - Virtual size: 7KB

_RDATA Size: 512B - Virtual size: 252B

.rsrc Size: 298KB - Virtual size: 298KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 135KB - Virtual size: 135KB

.rdata
Size: 77KB - Virtual size: 76KB

.data
Size: 4KB - Virtual size: 10KB

.pdata
Size: 7KB - Virtual size: 7KB

_RDATA
Size: 512B - Virtual size: 252B

.rsrc
Size: 298KB - Virtual size: 298KB

.reloc
Size: 2KB - Virtual size: 2KB