NEAS[.]2b2be30ba115edfcece5d0da31f76a30_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.2b2be30ba115edfcece5d0da31f76a30_JC.exe
Size

66KB
MD5

2b2be30ba115edfcece5d0da31f76a30
SHA1

018d1d19c526917dc3d67340b297312fc16bfe96
SHA256

06f9c09a795a20580ecab1dd135adfd1f7e3dbd5f48e76c3653ea5870332449d
SHA512

366369743e0786869be2c27379a9b94264e5e830aba23d59dd36875e576b982beaf8d541489f489ce7b4778a21492a7572ddc705c32104653b40c79aac749cc6
SSDEEP

1536:yDi+YTRXOFNTzuOhTsTDRYMeNpaTdNPl8W78Ms0Ir24s:yIdXOndhTs5ZeYNPKW7zHICV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.2b2be30ba115edfcece5d0da31f76a30_JC.exe

Files

NEAS.2b2be30ba115edfcece5d0da31f76a30_JC.exe
.exe windows:4 windows x86

9c4fd48f8b8be7d242318eef59167775

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindNextVolumeMountPointA
ReadFileScatter
TermsrvSetValueKey
OutputDebugStringA
BasepNotifyLoadStringResource
EnumDateFormatsA
ConvertFiberToThread
ResolveDelayLoadsFromDll
Wow64GetThreadContext
Basep8BitStringToDynamicUnicodeString

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE