NEAS[.]25d55cfc6cdf2a9e620c5e0ad4505aa0_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.25d55cfc6cdf2a9e620c5e0ad4505aa0_JC.exe
Size

112KB
MD5

25d55cfc6cdf2a9e620c5e0ad4505aa0
SHA1

64d43a7a276466cde280d9e22a3548191e8569c6
SHA256

e3d7e17ae2d2c819793d16c55c49a11150310eeb30ce6286a2e98757bfb4cbc9
SHA512

bb5611005f12c9c9ba428ea511c87480468a81a385a0b21cbbe62b050f82ea704d9cc86f5ead0852431dd70c018dbae4e1d45ceae7ce0634d1c69efa0d2f27f0
SSDEEP

768:Fl1aJ1lOXRhMZrKfoSyB/PVEaSQ3PyPr7J8ygV6wODWsh4bsB1MAi89d98AqE2/x:FTaJWXRhMZmasXHAfsGAi89d98At46

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.25d55cfc6cdf2a9e620c5e0ad4505aa0_JC.exe

Files

NEAS.25d55cfc6cdf2a9e620c5e0ad4505aa0_JC.exe
.exe windows:4 windows x86

9eeefa7f6cdca34a42a6c3913e8fb403

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetCommandLineW
GetTempFileNameW
FreeResource
FindResourceW
LoadResource
CreateProcessW
WaitForSingleObject
GetModuleHandleW
GetTickCount
WriteFile
SizeofResource
GetFileAttributesW
GetModuleFileNameW
CreateFileW
lstrlenW
GetTempPathW
LockResource
lstrcatW
CloseHandle

shell32

SHFileOperationW

shlwapi

StrChrW
StrRChrW

msvcrt

??2@YAPAXI@Z
??3@YAXPAX@Z
malloc
free
memmove
memset

Sections

pe
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ