NEAS[.]e36659942b58f073f8231e1a6dd7d790_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.e36659942b58f073f8231e1a6dd7d790_JC.exe
Size

132KB
MD5

e36659942b58f073f8231e1a6dd7d790
SHA1

f12e9bdb1445d9e7a668aa74a53b04b63c741360
SHA256

fb8cf6832c3c10aa21806205d3187bfab0e0d5986b2a48b20a9d0a7179606f09
SHA512

f62a4e5c9c193516f72750a7f5f019d3b858deaf435d6ca269f995f348f0ef3b4a92d2a0f4bcb53bf57106d98222db41ab5f34c366a5a9cd7665828cd6080442
SSDEEP

3072:5no0w+NRCypAV0TSGsnZkXL0H103DIh+B0lOMG:5o0wDpnZkXL0eTIh+B0lc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.e36659942b58f073f8231e1a6dd7d790_JC.exe

Files

NEAS.e36659942b58f073f8231e1a6dd7d790_JC.exe
.exe windows:5 windows x86

08f68a4379abbfdda9660d304f02119c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

mssws

LsaOpenPolicy
LsaClose
LsaNtStatusToWinError
LsaFreeMemory
LsaRetrievePrivateData
LsaStorePrivateData
CryptAcquireContextW
OpenMutexW
OpenFileMappingW
FindNextFileW
GetLengthSid
IsValidSid
GetCommandLineW
SetSecurityDescriptorGroup
RegOpenKeyExW
RegEnumKeyExW
RegEnumValueW
RegDeleteValueW
RegCreateKeyExW
RegDeleteKeyW
RegSetValueExW
RegQueryValueExW
CharUpperBuffW
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
OpenThreadToken
GetEnvironmentVariableW
SetEnvironmentVariableW
GetTokenInformation
CreateEventW
OpenProcessToken
CopySid
FindFirstFileW
RevertToSelf
GetComputerNameW
DispatchMessageW
PeekMessageW
OpenEventW
ImpersonateLoggedOnUser
CoInitializeSecurity
GetModuleHandleW
LoadLibraryW
LogonUserW
CharUpperW
DuplicateToken
CreateFileW
InterlockedCompareExchange
lstrlenW
DeleteFileW

msvcrt

_wtol
_wcsnicmp
wcschr
wcscmp
_exit
_controlfp
??1type_info@@UAE@XZ
_onexit
__dllonexit
_XcptFilter
_acmdln
?terminate@@YAXXZ
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
exit
_wcsicmp
free
_ultow
??2@YAPAXI@Z
_itow
_purecall
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_CxxThrowException
_wtoi
_EH_prolog
__CxxFrameHandler
??3@YAXPAX@Z
realloc
malloc
isalnum
iswspace
wcscpy
wcslen
wcsncpy

advapi32

RegCloseKey
CryptHashData
CryptCreateHash
CryptGenRandom
CryptDeriveKey
CryptDestroyHash
CryptDecrypt
CryptEncrypt
CryptReleaseContext
CryptDestroyKey
InitializeSecurityDescriptor
GetSecurityDescriptorLength

kernel32

FindClose
Sleep
GetSystemInfo
VirtualFree
VirtualAlloc
ReleaseMutex
WaitForMultipleObjects
SetErrorMode
SetLastError
GetCurrentProcessId
GetLastError
GetVersionExA
GetCurrentProcess
HeapReAlloc
UnmapViewOfFile
MapViewOfFile
GetStartupInfoA
GetModuleHandleA
EnterCriticalSection
GetTickCount
FreeLibrary
LoadLibraryA
GetProcessHeap
HeapAlloc
HeapFree
CreateThread
InterlockedDecrement
GetProcAddress
CloseHandle
InitializeCriticalSection
DeleteCriticalSection
SetEvent
WaitForSingleObject
GetCurrentThreadId
ExitProcess
LeaveCriticalSection
GetCurrentThread
InterlockedIncrement
GlobalFree
OpenProcess
MultiByteToWideChar
IsValidCodePage
GetSystemDefaultLCID
WriteFile
ExitThread
SetThreadPriority

user32

RegisterClassExA
DestroyWindow
DefWindowProcA
PostQuitMessage
CreateWindowExA

iprop

StgCreatePropSetStg
PropVariantClear
PropVariantCopy

ole32

CoTaskMemRealloc
CoCreateInstance
StringFromCLSID
CLSIDFromString
CLSIDFromProgID
CoTaskMemAlloc
CoUninitialize
CoInitializeEx
CoTaskMemFree
StgOpenStorage

oleaut32

GetErrorInfo
SysStringLen
SysFreeString

Sections

.text
Size: 116KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

08f68a4379abbfdda9660d304f02119c

Headers

DLL Characteristics

File Characteristics

Imports

mssws

msvcrt

advapi32

kernel32

user32

iprop

ole32

oleaut32

Sections

.text Size: 116KB - Virtual size: 114KB

.data Size: 4KB - Virtual size: 24KB

.rsrc Size: 8KB - Virtual size: 128KB

.text
Size: 116KB - Virtual size: 114KB

.data
Size: 4KB - Virtual size: 24KB

.rsrc
Size: 8KB - Virtual size: 128KB