NEAS[.]e0fb822e1d9cc4eb00ab2326dfe6a2e0_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.e0fb822e1d9cc4eb00ab2326dfe6a2e0_JC.exe
Size

3.4MB
MD5

e0fb822e1d9cc4eb00ab2326dfe6a2e0
SHA1

f562c8fa7f484fb453b08551a76f23fb074a4e16
SHA256

068da8b0eae40a86be06efba0979bb55da83a9f29effbad4357a1bde991c9fb9
SHA512

37ea4a6d35b89a1eb5e1eb4f9dcc5ab36acac8e3c447d56fe8e95df4202f908337dbce79ca8100b5305379d24cdcb5d89cf0b9397251184fc821178a63ca9b4c
SSDEEP

98304:j4pe+1KaQH1z0oWvRWZQzDuO61PMrTOhJFFS:Er1roAoWvRjPX61rhJFFS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.e0fb822e1d9cc4eb00ab2326dfe6a2e0_JC.exe

Files

NEAS.e0fb822e1d9cc4eb00ab2326dfe6a2e0_JC.exe
.exe windows:5 windows x86

b849eafc8630dfa2823f4363fcec2bd6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

shell32

SHGetFolderPathA

d3d9

Direct3DCreate9

winmm

timeEndPeriod

wsock32

gethostbyname

user32

DefWindowProcW

gdi32

DeleteObject

advapi32

RegQueryValueExA

ole32

CoInitialize

oleaut32

VariantClear

Sections

.text
Size: 3.3MB - Virtual size: 6.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE