NEAS[.]003b3cb79605354e69306a26aa3321f0_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.003b3cb79605354e69306a26aa3321f0_JC.exe
Size

4.8MB
MD5

003b3cb79605354e69306a26aa3321f0
SHA1

5b887b53488f8c24ec047dc614ffaf38ab1c5767
SHA256

5bf6423ccf345ca6000a58b87c219c622ad7802ba6053ea7c112a09cfc8ea015
SHA512

426257b63671f28dcc6e95876c901e320a208562ecfae0e02921eb666b137f2253fc804995c18cf88c50d1f20fdd3057340ce49e408345723e83cdc59a360e19
SSDEEP

98304:DhY/cesBGKAOVV2TBnorijDD31GoLCjwcFvP7sqf4k4uMvA0eoChs2Wr4nR:DhY/cesBGKAOVV2TBnorijDD3ooGsWPK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.003b3cb79605354e69306a26aa3321f0_JC.exe

Files

NEAS.003b3cb79605354e69306a26aa3321f0_JC.exe
.exe windows:4 windows x86

0f1baf607fad0761e568d29b092520b9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

imm32

ImmGetDescriptionA
ImmGetIMEFileNameA
ImmGetDefaultIMEWnd
ImmGetCompositionStringA
ImmGetCompositionWindow
ImmGetProperty
ImmGetContext
ImmGetOpenStatus
ImmSetOpenStatus
ImmGetConversionStatus
ImmSetConversionStatus
ImmReleaseContext
ImmNotifyIME
ImmSetCompositionWindow

dsound

ord1
ord2

dinput8

DirectInput8Create

opengl32

glFogfv
glFogi
wglDeleteContext
wglMakeCurrent
glGetString
wglCreateContext
glClearColor
glTexEnvi
glGetIntegerv
glColor3ub
glTexSubImage2D
glViewport
glBlendFunc
glReadPixels
glGetFloatv
glScalef
glStencilOp
glColorMask
glStencilFunc
glFrontFace
glPolygonMode
glDepthMask
glTexEnvf
glGenTextures
glTexParameteri
glDeleteTextures
glColor3fv
glVertex3fv
glNormal3f
glVertex3f
glMatrixMode
glPushMatrix
glLoadIdentity
glRotatef
glTranslatef
glDepthFunc
glAlphaFunc
glPopMatrix
glClear
glFlush
glBindTexture
glTexImage2D
glColor3f
glBegin
glColor4ub
glTexCoord2f
glVertex2f
glEnd
glDisable
glEnable
glColor4f
glFogf

glu32

gluPerspective
gluOrtho2D

winmm

mmioDescend
mmioOpenA
mmioWrite
mmioRead
timeGetDevCaps
timeEndPeriod
mmioAscend
timeGetTime
mmioClose
timeBeginPeriod

kernel32

TlsFree
TlsAlloc
TlsSetValue
HeapSize
CompareStringW
CompareStringA
GetCPInfo
LCMapStringW
LCMapStringA
FatalAppExitA
HeapReAlloc
GetSystemTimeAsFileTime
HeapAlloc
GetVersion
GetStartupInfoA
GetSystemTime
GetTimeZoneInformation
HeapFree
RaiseException
RtlUnwind
MultiByteToWideChar
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
TlsGetValue
GetACP
GetOEMCP
LeaveCriticalSection
DeleteCriticalSection
InterlockedExchange
InitializeCriticalSection
EnterCriticalSection
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFullPathNameA
GetTickCount
IsBadReadPtr
lstrlenA
GlobalUnlock
GlobalLock
OutputDebugStringA
GetCurrentThreadId
Sleep
SetHandleCount
GetCommandLineA
CloseHandle
ReadFile
GetFileSize
GetLastError
GetPrivateProfileStringA
GetCurrentDirectoryA
DeleteFileA
CopyFileA
SetFileAttributesA
Process32Next
TerminateProcess
OpenProcess
Process32First
CreateToolhelp32Snapshot
WinExec
FindClose
FindFirstFileA
CreateMutexA
GetLocalTime
GetModuleFileNameA
SetFilePointer
WriteFile
GetSystemDirectoryA
lstrcmpiA
GetVersionExA
QueryPerformanceCounter
SetProcessAffinityMask
SetThreadPriority
SetPriorityClass
GetProcessAffinityMask
GetThreadPriority
GetPriorityClass
GetCurrentThread
GetCurrentProcess
QueryPerformanceFrequency
FreeLibrary
GetProcAddress
LoadLibraryA
GlobalMemoryStatus
ExitProcess
SetConsoleMode
GetStdHandle
AllocConsole
FreeConsole
SetConsoleTitleA
GetConsoleTitleA
SetLastError
SetConsoleCursorPosition
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
ReadConsoleOutputA
GetCurrentProcessId
GetModuleHandleA
GetNumberFormatA
FindNextFileA
RemoveDirectoryA
GetFileAttributesA
CreateDirectoryA
GetThreadContext
lstrcpynA
Module32First
Module32Next
SetUnhandledExceptionFilter
GetFileType
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
FlushFileBuffers
GetLocaleInfoW
GetStringTypeA
GetStringTypeW
IsBadCodePtr
SetStdHandle
SetEnvironmentVariableA
SetEndOfFile
SetConsoleCtrlHandler
CreateFileA

user32

SetWindowTextA
GetWindowTextA
GetCaretPos
GetWindowLongA
GetAsyncKeyState
SetWindowPos
CallWindowProcA
OpenClipboard
GetClipboardData
CloseClipboard
ShowWindow
DestroyWindow
SendMessageA
GetDC
CreateWindowExA
SetFocus
GetFocus
GetScrollPos
SetScrollPos
SetTimer
wsprintfA
IntersectRect
GetDesktopWindow
SetWindowsHookExA
UnhookWindowsHookEx
ClientToScreen
GetWindowThreadProcessId
GetClassNameA
GetSystemMenu
DrawMenuBar
IsWindowVisible
RemoveMenu
EnumChildWindows
wvsprintfA
GetKeyboardLayout
GetKeyboardLayoutNameA
KillTimer
EnumDisplaySettingsA
UpdateWindow
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
SetRect
GetActiveWindow
GetCursorPos
ScreenToClient
GetDoubleClickTime
PtInRect
OffsetRect
MessageBoxA
PostMessageA
IsIconic
AdjustWindowRect
GetSystemMetrics
SetForegroundWindow
LoadIconA
LoadCursorA
RegisterClassA
BeginPaint
EndPaint
PostQuitMessage
DefWindowProcA
SetCapture
ReleaseCapture
SystemParametersInfoA
ReleaseDC
ChangeDisplaySettingsA
ShowCursor
FindWindowA
SetCursorPos
UnregisterHotKey
RegisterHotKey
GetWindowRect
SetWindowLongA
CallNextHookEx

gdi32

SetBkMode
SetPixelFormat
GetStockObject
ChoosePixelFormat
SetTextAlign
CreateFontIndirectA
GetTextExtentExPointA
GetTextExtentPoint32A
CreateFontA
DeleteObject
SelectObject
CreateCompatibleDC
CreateDIBSection
DeleteDC
SetTextColor
SetBkColor
GetTextExtentPointA
TextOutA
SwapBuffers

advapi32

RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegCloseKey

shell32

ShellExecuteA

ole32

CoInitialize
CoCreateInstance
CoUninitialize

ws2_32

socket
WSAGetLastError
send
WSACleanup
WSAStartup
closesocket
recv
inet_addr
gethostbyname
connect
WSAAsyncSelect
setsockopt
htons
shutdown

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

wzaudio

wzAudioPlay
wzAudioOption
wzAudioCreate
wzAudioStop
wzAudioDestroy
wzAudioGetStreamOffsetRange

Sections

.text
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 208KB - Virtual size: 207KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 180KB - Virtual size: 122.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdate
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0f1baf607fad0761e568d29b092520b9

Headers

File Characteristics

Imports

imm32

dsound

dinput8

opengl32

glu32

winmm

kernel32

user32

gdi32

advapi32

shell32

ole32

ws2_32

version

wzaudio

Sections

.text Size: 4.4MB - Virtual size: 4.4MB

.rdata Size: 208KB - Virtual size: 207KB

.data Size: 180KB - Virtual size: 122.2MB

.rsrc Size: 12KB - Virtual size: 8KB

.rdate Size: 31KB - Virtual size: 31KB

.text
Size: 4.4MB - Virtual size: 4.4MB

.rdata
Size: 208KB - Virtual size: 207KB

.data
Size: 180KB - Virtual size: 122.2MB

.rsrc
Size: 12KB - Virtual size: 8KB

.rdate
Size: 31KB - Virtual size: 31KB