NEAS[.]NEAS83b61fd1947041ad612cdce70d4ea1c64510643165c0fad3af7c27f7d0d42a01exeexe_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.NEAS83b61fd1947041ad612cdce70d4ea1c64510643165c0fad3af7c27f7d0d42a01exeexe_JC.exe
Size

612KB
MD5

1ab3118a7ed8ea3f8cbddacad1d76c6a
SHA1

09b59389e91ad32d296acc5c89ed910ca133353f
SHA256

83b61fd1947041ad612cdce70d4ea1c64510643165c0fad3af7c27f7d0d42a01
SHA512

ae089f214f9fdafc64b5e68d115285df4a3c1d4e2318b5437b4d10fa11fca57907f3fc1664adf158efcab1f27a033ef57cd3d66bc73719a6793bf08c9382139d
SSDEEP

12288:6tURNuTk1e1g7azAFhWMjRgTE2QN4IODJGVtAZ:6t2NuWnRFMo4EPcD0i

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.NEAS83b61fd1947041ad612cdce70d4ea1c64510643165c0fad3af7c27f7d0d42a01exeexe_JC.exe

Files

NEAS.NEAS83b61fd1947041ad612cdce70d4ea1c64510643165c0fad3af7c27f7d0d42a01exeexe_JC.exe
.dll windows:10 windows x64

d5ce0c257f20636ebf1c4329e07c12fb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

memcpy
floor
_vsnwprintf
cos
memmove
atan
memset
?terminate@@YAXXZ
pow
fflush
fputws
memcmp
fwprintf
sqrt
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
_initterm
malloc
_amsg_exit
_XcptFilter
__C_specific_handler
wcstol
memmove_s
_wsplitpath_s
_wtof
wcschr
free
_purecall
rand
memcpy_s
rand_s

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
DisableThreadLibraryCalls
FreeLibraryAndExitThread
GetModuleFileNameW
FindResourceExW
SizeofResource
LoadResource
LoadStringW
LoadLibraryExW
GetModuleFileNameA
LockResource
GetModuleHandleW
GetProcAddress
FreeLibrary

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
ReleaseSemaphore
InitializeCriticalSection
CreateMutexExW
ReleaseMutex
WaitForSingleObjectEx
InitializeCriticalSectionEx
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
CreateMutexW
ReleaseSRWLockShared
ReleaseSRWLockExclusive
EnterCriticalSection
InitializeSRWLock
OpenSemaphoreW
AcquireSRWLockExclusive
AcquireSRWLockShared
CreateSemaphoreExW

api-ms-win-core-heap-l1-1-0

HeapCreate
HeapFree
HeapReAlloc
HeapDestroy
HeapAlloc
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
TlsFree
TlsAlloc
TlsSetValue
TlsGetValue
GetCurrentThread
TerminateProcess
SetThreadToken
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
CreateThread
OpenThreadToken

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetACP

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime
GetVersionExW
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTickCount
GetSystemInfo

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-file-l1-1-0

GetFileTime
ReadFile
SetFilePointer
GetFileAttributesW
FindClose
CreateFileW
FindNextFileW
FindFirstFileW
GetFullPathNameW
GetFileSize

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringW
CompareStringOrdinal
GetStringTypeW

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW
RoOriginateError

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize
InitOnceExecuteOnce
Sleep

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegGetValueW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegOpenCurrentUser

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-security-base-l1-1-0

ImpersonateLoggedOnUser
CopySid
GetLengthSid
RevertToSelf
IsValidSid
CheckTokenMembership
SetKernelObjectSecurity
GetTokenInformation

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
VirtualAlloc
VirtualFree
MapViewOfFile

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-sidebyside-l1-1-0

ActivateActCtx
CreateActCtxW
ReleaseActCtx
DeactivateActCtx

api-ms-win-core-atoms-l1-1-0

DeleteAtom
GetAtomNameW
AddAtomW

api-ms-win-core-kernel32-legacy-l1-1-0

MulDiv

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW
lstrcmpW
lstrcmpiW

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrRStrIW

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

ntdll

wcstok_s
strchr
SbSelectProcedure
wcsspn
wcstoul
NtCreateSection
NtOpenSection
NtClose
NtConnectPort
RtlInitUnicodeString
NtRequestWaitReplyPort
RtlInitializeCriticalSection
RtlGetThreadLangIdByIndex
EtwEventSetInformation
EtwEventUnregister
EtwEventRegister
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockShared
RtlReleaseSRWLockShared
RtlInitializeSRWLock
EtwEventWriteTransfer
bsearch_s

gdi32

GetStockObject
CreateDIBitmap
SelectObject
GetClipRgn
CreateRectRgn
IntersectClipRect
CreatePen
CreateSolidBrush
Rectangle
RoundRect
BeginPath
EndPath
Ellipse
SelectClipPath
BitBlt
SelectClipRgn
SetBkColor
ExtTextOutW
GetBkColor
PathToRegion
GetObjectType
ExcludeClipRect
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectW
GetDCDpiScaleValue
CreateDPIScaledDIBSection
CreateDIBSection
DeleteDC
GetLayout
GetRandomRgn
LPtoDP
OffsetRgn
GetDeviceCaps
GdiFlush
SetViewportOrgEx
SetWindowOrgEx
CreateRectRgnIndirect
GdiAlphaBlend
SetStretchBltMode
StretchBlt
CreateFontIndirectW
PtInRegion
GdiGradientFill
Arc
SetLayout
GetRegionData
GdiDrawStream
SetTextColor
SetBkMode
GetRgnBox
GetCurrentObject
GetWindowOrgEx
GetViewportOrgEx
SetBitmapAttributes
SetTextAlign
GetTextAlign
GetDIBits
CreatePatternBrush
RectVisible
GetClipBox
SetBrushOrgEx
SetDIBits
ExtCreateRegion
CombineRgn
ExtCreatePen
AbortPath
StrokeAndFillPath
GetTextMetricsW
PatBlt
GdiTransparentBlt
SetBoundsRect
GetBoundsRect
CreateSessionMappedDIBSection
ClearBitmapAttributes
DeleteObject

user32

CallWindowProcW
SetWindowLongW
SetWindowLongPtrW
GetWindowLongW
DefWindowProcW
GetDCEx
IsChild
GetWindowThreadProcessId
PostMessageW
ord2525
ord2527
GetDesktopWindow
ReleaseDC
GetDC
SetSysColors
SetProcessDPIAware
GetClassNameW
EnumDesktopsW
CloseDesktop
EnumDesktopWindows
OpenDesktopW
EnumChildWindows
GetWindow
RemovePropW
SetPropW
ord2705
ord2706
IsThreadDesktopComposited
IsTopLevelWindow
GetSysColor
SystemParametersInfoW
SendNotifyMessageW
GetPropW
InflateRect
DrawTextW
DrawTextExW
GetGUIThreadInfo
GetUserObjectInformationW
GetProcessWindowStation
CopyRect
GetSystemMetrics
PtInRect
WindowFromDC
RedrawWindow
KillTimer
SetTimer
EqualRect
OffsetRect
MapWindowPoints
GetWindowRect
IsRectEmpty
IntersectRect
SetRect
FillRect
IsWindow
TrackMouseEvent
GetWindowCompositionAttribute
SetWindowCompositionAttribute
SetWindowPos
GetClassLongW
GetClientRect
GetSystemMetricsForDpi
GetAncestor
SendMessageW
MonitorFromWindow
GetMonitorInfoW
IsZoomed
GetTitleBarInfo
GetSystemMenu
GetMenuItemInfoW
GetIconInfo
CreateIconIndirect
GetWindowLongPtrW
GetParent
GetWindowInfo
IsIconic
GetForegroundWindow
GetWindowRgnBox
InvalidateRect
IsWindowInDestroy
SetWindowRgn
SetRectEmpty
CalcMenuBar
InternalGetWindowText
GetWindowTextW
GetWindowDC
LoadIconW
DestroyIcon
SetCapture
MsgWaitForMultipleObjectsEx
PeekMessageW
ReleaseCapture
DispatchMessageW
GetCapture
ClientToScreen
DrawEdge
DrawIconEx
IsWindowVisible
IsWindowRedirectedForPrint
PaintMenuBar
GetSysColorBrush
ValidateRect
DefFrameProcW
IsServerSideWindow
MonitorFromRect
GetMessagePos
GetKeyState
GetMenuBarInfo
GetMenuItemCount
DrawMenuBar
ord2707
GetDpiForSystem
SetMenuItemInfoW
CopyImage
RegisterUserApiHook
ord2708
SystemParametersInfoA
SystemParametersInfoForDpi
AdjustWindowRectEx
GetWindowPlacement
FindWindowW
GetShellWindow
SetWindowsHookExW
UnhookWindowsHookEx
AllowSetForegroundWindow
CallNextHookEx
IsMenu
GetMenuInfo
SendMessageTimeoutW
GetClassLongPtrW
GetThreadDesktop
IsProcessDPIAware
EnumDisplayDevicesW
ord2703
DisplayConfigGetDeviceInfo
GetDpiForMonitorInternal
ord2711
EnumDisplayMonitors
EnumDisplaySettingsW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

BeginBufferedAnimation
BeginBufferedPaint
BeginPanningFeedback
BufferedPaintClear
BufferedPaintInit
BufferedPaintRenderAnimation
BufferedPaintSetAlpha
BufferedPaintStopAllAnimations
BufferedPaintUnInit
CloseThemeData
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DrawThemeBackground
DrawThemeBackgroundEx
DrawThemeEdge
DrawThemeIcon
DrawThemeParentBackground
DrawThemeParentBackgroundEx
DrawThemeText
DrawThemeTextEx
EnableThemeDialogTexture
EnableTheming
EndBufferedAnimation
EndBufferedPaint
EndPanningFeedback
GetBufferedPaintBits
GetBufferedPaintDC
GetBufferedPaintTargetDC
GetBufferedPaintTargetRect
GetColorFromPreference
GetCurrentThemeName
GetImmersiveColorFromColorSetEx
GetImmersiveUserColorSetPreference
GetThemeAnimationProperty
GetThemeAnimationTransform
GetThemeAppProperties
GetThemeBackgroundContentRect
GetThemeBackgroundExtent
GetThemeBackgroundRegion
GetThemeBitmap
GetThemeBool
GetThemeColor
GetThemeDocumentationProperty
GetThemeEnumValue
GetThemeFilename
GetThemeFont
GetThemeInt
GetThemeIntList
GetThemeMargins
GetThemeMetric
GetThemePartSize
GetThemePosition
GetThemePropertyOrigin
GetThemeRect
GetThemeStream
GetThemeString
GetThemeSysBool
GetThemeSysColor
GetThemeSysColorBrush
GetThemeSysFont
GetThemeSysInt
GetThemeSysSize
GetThemeSysString
GetThemeTextExtent
GetThemeTextMetrics
GetThemeTimingFunction
GetThemeTransitionDuration
GetUserColorPreference
GetWindowTheme
HitTestThemeBackground
IsAppThemed
IsCompositionActive
IsThemeActive
IsThemeBackgroundPartiallyTransparent
IsThemeDialogTextureEnabled
IsThemePartDefined
OpenThemeData
OpenThemeDataEx
OpenThemeDataForDpi
SetThemeAppProperties
SetWindowTheme
SetWindowThemeAttribute
ThemeInitApiHook
UpdatePanningFeedback

Sections

.text
Size: 373KB - Virtual size: 373KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 200KB - Virtual size: 199KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d5ce0c257f20636ebf1c4329e07c12fb

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-sidebyside-l1-1-0

api-ms-win-core-atoms-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

ntdll

gdi32

user32

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 373KB - Virtual size: 373KB

.rdata Size: 200KB - Virtual size: 199KB

.data Size: 5KB - Virtual size: 11KB

.pdata Size: 24KB - Virtual size: 23KB

.didat Size: 512B - Virtual size: 248B

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 373KB - Virtual size: 373KB

.rdata
Size: 200KB - Virtual size: 199KB

.data
Size: 5KB - Virtual size: 11KB

.pdata
Size: 24KB - Virtual size: 23KB

.didat
Size: 512B - Virtual size: 248B

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 4KB