NEAS[.]0ce4da45baea6196a894529e5f7cbbe0_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.0ce4da45baea6196a894529e5f7cbbe0_JC.exe
Size

39KB
MD5

0ce4da45baea6196a894529e5f7cbbe0
SHA1

3dc6d16d582e9a54bd6f65ae9e330ddd3d4ad457
SHA256

a8645aa721231e94f6f6f0a12e134c8d92ddcced9ca0d3d57b75ba13d21f6dd1
SHA512

0aa9075644a144e31420ad4dbcdd4920b3642dd9529de30437687512536d64cce9b74c765cb70443da7f97e1241e7a04b5ac47b91de84888a167a19ab310268f
SSDEEP

768:/zSJcDSWD6z3afvJc0cFOF+Mj0prJyokyWURPF8NQvUB8PAlN7:/zLDSWmz3QJhcFOF+Mj0prJyokyWURPE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.0ce4da45baea6196a894529e5f7cbbe0_JC.exe

Files

NEAS.0ce4da45baea6196a894529e5f7cbbe0_JC.exe
.exe windows:4 windows x86

2dd6c80642b2098b8e4d0e817889d29d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

LoadStringA
LoadCursorA
LoadIconA
RegisterClassExA
GetMessageA
ShowWindow
CreateWindowExA
DefWindowProcA
PostMessageA
SendMessageA
TranslateMessage
DispatchMessageA
BeginPaint
EndPaint
PostQuitMessage
SetFocus
DestroyWindow
UpdateWindow

kernel32

lstrlenA
GetModuleHandleA
GetStartupInfoA
LoadLibraryA
WriteProcessMemory
CreateDirectoryA

gdi32

TextOutA

wtsapi32

WTSEnumerateProcessesA
WTSLogoffSession
WTSQuerySessionInformationA
WTSWaitSystemEvent

crtdll

_initterm
_exit
_local_unwind2
_global_unwind2
_fmode_dll
_commode_dll
__GetMainArgs
_XcptFilter
_acmdln_dll
exit
??2@YAPAXI@Z

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ