NEAS[.]111c85e1a3cc7663de26bc23f29fe510_JC[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.111c85e1a3cc7663de26bc23f29fe510_JC.exe
Size

166KB
MD5

111c85e1a3cc7663de26bc23f29fe510
SHA1

6d145019d54a1996dfdcd2d0847f0a3e9078658b
SHA256

d3ad0a04e60d1c1ded542db37bf67b291a406080fa7f88ffcd179a20f56b2ee0
SHA512

4eeb3566ef41ea7494d5668ba2bf072e25c014120adb2c842449eba0913f089d65be9994bd6a799784db3b1925017c0b96f34af12a2d46654f2af9e5bc2d8bc4
SSDEEP

3072:btmeY8BCjHJAVG8H+FZVyhk5RzIBPXSRxZxDxxfIXK+:RYjHJ9k0fRzIkZHFIXK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.111c85e1a3cc7663de26bc23f29fe510_JC.exe

Files

NEAS.111c85e1a3cc7663de26bc23f29fe510_JC.exe
.dll windows:6 windows x64

9cfee080f4ad0211faf14e741dab785a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_unlock
__CxxFrameHandler3
_lock
_wtoi
_vsnwprintf
memset
_onexit
memcpy
__C_specific_handler
_XcptFilter
_amsg_exit
free
malloc
__dllonexit
_initterm

ntdll

RtlDeleteResource
RtlReleaseResource
RtlAcquireResourceExclusive
RtlInitializeResource
RtlGetNtProductType
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlInitUnicodeString

api-ms-win-core-heap-l1-2-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
TerminateProcess
GetCurrentProcess
CreateProcessW
GetCurrentProcessId
CreateThread
OpenProcessToken
GetCurrentThread
OpenThreadToken
TlsGetValue
TlsAlloc
TlsFree
TlsSetValue

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-security-lsalookup-l2-1-1

LookupAccountNameW
LookupAccountSidW

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadStringW
FreeLibrary

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-security-base-l1-2-0

FreeSid
CopySid
GetLengthSid
AllocateAndInitializeSid
EqualSid
GetTokenInformation
IsValidSid

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep
OpenEventW
ResetEvent
CreateEventW
WaitForSingleObject
SetEvent

api-ms-win-core-com-l1-1-1

CoInitializeEx
CoGetMalloc
CoUninitialize
CoTaskMemFree
CoCreateInstance

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
RegDeleteValueW

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount
SetComputerNameExW

api-ms-win-core-file-l1-2-1

GetDriveTypeW

mpr

WNetGetUniversalNameW
WNetGetConnectionW
WNetCancelConnection2W
WNetAddConnection3W

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-security-activedirectoryclient-l1-1-0

DsFreeNameResultW
DsCrackNamesW

api-ms-win-security-lsapolicy-l1-1-0

LsaOpenPolicy
LsaClose
LsaStorePrivateData

user32

SendDlgItemMessageW
EndDialog
GetDlgItemTextW
SetFocus
GetWindowLongPtrW
SetWindowLongPtrW
SetCursor
LoadCursorW
GetMenuItemInfoW
DeleteMenu
GetDlgItem
GetMenuItemCount
IsWindowEnabled
GetWindowTextLengthW
GetWindowTextW
MessageBoxW
EnableWindow
GetWindowRect
MapWindowPoints
GetParent
OffsetRect
SetWindowPos
FindWindowW
IsWindow
SetForegroundWindow
DialogBoxParamW
RegisterClipboardFormatW
SendMessageW
UnhookWindowsHookEx
DestroyAcceleratorTable
RedrawWindow
LoadAcceleratorsW
SetWindowsHookExW
TranslateAcceleratorW
GetDesktopWindow
GetClientRect
IsDlgButtonChecked
CheckRadioButton
IsWindowVisible
LoadIconW
DestroyIcon
ShowWindow
PostMessageW
SetDlgItemTextW
GetSystemMetrics
CallNextHookEx
RegisterWindowMessageW
LoadImageW
GetWindowLongW
SetWindowTextW

gdi32

GetObjectW
DeleteObject
CreateFontIndirectW

shell32

ord169
ord258
ShellExecuteExW
ord100
ord155
SHBrowseForFolderW
SHGetSpecialFolderLocation
SHGetFileInfoW
ord194
ord167
ord730
ord817
ord818
SHGetPathFromIDListEx
ord18
SHCreateItemFromIDList
SHGetFolderLocation

shlwapi

ord215
StrRetToBufW
StrChrW
PathIsUNCW
ord388
StrCmpIW
StrToIntW
StrCmpW
ord158
PathRemoveBackslashW
ord16
ord219
ord174
ord199
ord481
ord478
ord172
PathGetDriveNumberW
ord168
PathBuildRootW

ole32

CoTaskMemAlloc
ReleaseStgMedium
CoInitialize

kernel32

RegQueryInfoKeyW
__chkstk
LoadLibraryExW
GetModuleFileNameW
DeactivateActCtx
ActivateActCtx
ReleaseActCtx
CreateActCtxW
GetModuleHandleW
LockResource
LoadResource
RegEnumValueW
RegGetValueW
lstrcmpiW
MulDiv
LoadLibraryW
DnsHostnameToComputerNameW
GetComputerNameW
GlobalUnlock
GlobalLock
LocalFree
LocalAlloc
lstrlenW
FindResourceExW

api-ms-win-core-path-l1-1-0

PathIsUNCEx

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

Exports

Exports

ClearAutoLogon
DllCanUnloadNow
DllGetClassObject
NetAccessWizard
NetPlacesWizardDoModal
SHDisconnectNetDrives
UsersRunDllW

Sections

.text
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 396B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9cfee080f4ad0211faf14e741dab785a

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

api-ms-win-core-heap-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-string-l2-1-0

api-ms-win-security-lsalookup-l2-1-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-1

api-ms-win-security-base-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-file-l1-2-1

mpr

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-security-activedirectoryclient-l1-1-0

api-ms-win-security-lsapolicy-l1-1-0

user32

gdi32

shell32

shlwapi

ole32

kernel32

api-ms-win-core-path-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 77KB - Virtual size: 76KB

.data Size: 512B - Virtual size: 5KB

.pdata Size: 3KB - Virtual size: 3KB

.idata Size: 8KB - Virtual size: 8KB

.didat Size: 512B - Virtual size: 304B

.rsrc Size: 75KB - Virtual size: 74KB

.reloc Size: 512B - Virtual size: 396B

.text
Size: 77KB - Virtual size: 76KB

.data
Size: 512B - Virtual size: 5KB

.pdata
Size: 3KB - Virtual size: 3KB

.idata
Size: 8KB - Virtual size: 8KB

.didat
Size: 512B - Virtual size: 304B

.rsrc
Size: 75KB - Virtual size: 74KB

.reloc
Size: 512B - Virtual size: 396B