NEAS[.]36740ec4c700fabf3199f0095a05dcf0_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.36740ec4c700fabf3199f0095a05dcf0_JC.exe
Size

200KB
MD5

36740ec4c700fabf3199f0095a05dcf0
SHA1

7cda524f8b1f89f844dc88c31cab7e8205361bda
SHA256

66134f7e9d460aa2c2e974175d0cb307a4916ce5e4c2fdb60f76e931958b929a
SHA512

3e6d06201ba038c5359a31580f307d15b89b206db8109c1cb3da0d7564098c42a03d45b981900673f94c2e198c0b3516d26f3fe21eb1b29685f2bb880f35ca6b
SSDEEP

3072:1L1YiQUe3N+LJYmTHqsd7dirm4R+yvrtCOH3gDhtPDXOD2IM2D/kNMYvN3XCot:Ve3N+0sRdirm6vhCEgDht7O22LkmYVx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.36740ec4c700fabf3199f0095a05dcf0_JC.exe

Files

NEAS.36740ec4c700fabf3199f0095a05dcf0_JC.exe
.exe windows:5 windows x86

5cb0e9627b41bda8a7d3946839b91cdd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetProcAddress
VirtualAlloc
VirtualFree
VirtualProtect

user32

GetDC

gdi32

Escape

advapi32

OpenProcessToken

shell32

ShellExecuteW

ws2_32

recv

oleacc

LresultFromObject

winspool.drv

OpenPrinterW

oleaut32

VariantClear

Sections

.text
Size: 94KB - Virtual size: 209KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 16KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 285KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 74KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.EEEE
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE