NEAS[.]169cad6cb65bb1ba2ef556df5a36cab0_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.169cad6cb65bb1ba2ef556df5a36cab0_JC.exe
Size

66KB
MD5

169cad6cb65bb1ba2ef556df5a36cab0
SHA1

c079a15bbdbb6767ff593c06a0be3ff8b993b23b
SHA256

159af78a41b076e531fd5a09c345ba6fe7258cb31d3f731c9df39fda69cc9a93
SHA512

559a13b828903a6e8f909c24b8c70983cf50bebce06efca6c062ff20e34894a5adc15d1976d7fe14d0f942b7ce0bb15b81f5691b5f40df0827b6bea7e5beeed3
SSDEEP

1536:2GRUG6H4L55z8taGh2a6VCwWCKDTHv2d72qqWuSK0ex:TZl5zxa6Vudjv8LVuSK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.169cad6cb65bb1ba2ef556df5a36cab0_JC.exe

Files

NEAS.169cad6cb65bb1ba2ef556df5a36cab0_JC.exe
.exe windows:4 windows x86

a1d94f2d36ae9db57a31812f93aec84d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleExW
Toolhelp32ReadProcessMemory
ResumeThread
Wow64Transition
lstrcpynA
AppPolicyGetLifecycleManagement
BaseElevationPostProcessing
DisableThreadLibraryCalls
DeleteBoundaryDescriptor

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE