NEAS[.]2034ee0c394b5deeabe4d0877f67a710_JC[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.2034ee0c394b5deeabe4d0877f67a710_JC.exe
Size

605KB
MD5

2034ee0c394b5deeabe4d0877f67a710
SHA1

7012277e670238548b54cb41104683f20bb7bc35
SHA256

30fdc2c9a1ebf63726be4154bb44ac052a1c0b655ec7612085f9d5d733cf5d0c
SHA512

2487c81e2f797cde9c1282701c113a77316c61635ef6bb6a85db627bb3f07c7b88503316c0cca6544730b94adbdd0dae1178b09ad1804c110d0d0d98afef0dec
SSDEEP

12288:qQVYwgeBG7VIfwA5l9krSqdpg80gOuNcVt5VVbzEDGlSX:qQz9G7vprS0pgB75nkalSX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.2034ee0c394b5deeabe4d0877f67a710_JC.exe

Files

NEAS.2034ee0c394b5deeabe4d0877f67a710_JC.exe
.exe windows:6 windows x64

322f1c1ff4870ee88af8af80b98138a2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mswsock

GetAcceptExSockaddrs
AcceptEx

ole32

CoUninitialize
CoInitializeEx

ws2_32

ntohs
bind
WSAGetOverlappedResult
WSAStartup
closesocket
WSARecv
WSASend
WSAAddressToStringA
htons
listen
htonl
WSACleanup
select
recv
WSASocketW
WSAGetLastError
inet_ntoa
setsockopt

mscoree

ClrCreateManagedInstance

webengine4

GetXSPHeap
LoadLibraryUsingFullPath
AttachHandleToThreadPool
XspLogEvent
InitializeLibrary
PrintResourceString
PerfCounterInitialize
AspnetLoadResourceDLL

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW

kernel32

InitializeSListHead
GetCurrentProcessId
QueryPerformanceCounter
GetProcessAffinityMask
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
RtlCaptureContext
GetVersionExW
GetSystemDirectoryW
HeapReAlloc
WideCharToMultiByte
FileTimeToSystemTime
lstrlenW
GetSystemTimeAsFileTime
FileTimeToLocalFileTime
LoadLibraryW
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetModuleHandleW
MultiByteToWideChar
HeapCreate
HeapDestroy
HeapAlloc
HeapFree
FreeLibrary
GetProcAddress
SetEvent
WaitForSingleObject
GetSystemInfo
CloseHandle
CreateEventW
SetWaitableTimer
Sleep
CreateThread
FormatMessageW
CreateWaitableTimerW
SetConsoleCtrlHandler
GetLastError
SwitchToThread

vcruntime140_clr0400

strchr
_purecall
memset
__C_specific_handler
memcpy
strstr

ucrtbase_clr0400

_configure_wide_argv
_initialize_wide_environment
_get_initial_wide_environment
_initterm
_initterm_e
exit
_exit
_set_fmode
__p___argc
__p___wargv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_set_app_type
_itoa_s
wcsncpy_s
wcscpy_s
__stdio_common_vswprintf
strtol
_seh_filter_exe
strncmp
__p__commode
__setusermatherr

Exports

Exports

STWNDCloseConnection
STWNDDeleteStateItem
STWNDEndOfRequest
STWNDGetLocalAddress
STWNDGetLocalPort
STWNDGetRemoteAddress
STWNDGetRemotePort
STWNDIsClientConnected
STWNDSendResponse

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

322f1c1ff4870ee88af8af80b98138a2

Headers

DLL Characteristics

File Characteristics

Imports

mswsock

ole32

ws2_32

mscoree

webengine4

advapi32

kernel32

vcruntime140_clr0400

ucrtbase_clr0400

Exports

Exports

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 6KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 6KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 568KB - Virtual size: 572KB