NEAS[.]1bf422f2f0da146c9b3ba5dc8896b920_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.1bf422f2f0da146c9b3ba5dc8896b920_JC.exe
Size

66KB
MD5

1bf422f2f0da146c9b3ba5dc8896b920
SHA1

39481b5b8511cf81a8409de849856961a31834a8
SHA256

1c4fd379cf5be959215160952c2b3e605748b80752e1a275f99b092868e54391
SHA512

c1e3c87a68e06c50a6da7371065aae6520699f95e1bd17dd12a2839f8aea9cf7a109c6a0df359e984916159ffeadd53c291392aea6349928dcd91ac0d668a330
SSDEEP

1536:Po3lujPE5R2ouQ14j1g10Ot+kZtF4Jed1mgkSkNzL2QuE1:2QjPeIouNzOAkZDdqS81

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.1bf422f2f0da146c9b3ba5dc8896b920_JC.exe

Files

NEAS.1bf422f2f0da146c9b3ba5dc8896b920_JC.exe
.exe windows:4 windows x86

fa10eb43d7f2f3cd1b67d661ab3edcf4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetThreadId
QueueUserWorkItem
RegOpenCurrentUser
IsEnclaveTypeSupported
ReadProcessMemory
PssWalkSnapshot
RemoveLocalAlternateComputerNameW
K32EnumPageFilesA
AppPolicyGetCreateFileAccess
IsProcessorFeaturePresent

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE