NEAS[.]8901551a89e53cfd4d134593c83225f0_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.8901551a89e53cfd4d134593c83225f0_JC.exe
Size

66KB
MD5

8901551a89e53cfd4d134593c83225f0
SHA1

8f7ab06b9374f65e1060df6f37c49a2d953899d6
SHA256

658ee533deb00b358f50d97dd48d20edc9e68ca4ec6fd7b69a4a76d7450c7ac9
SHA512

96f2e20d4322c75510e87251d09a560ccad06deca55ee8a9782d2fb79cf5006addb4492d92104cb4faa597c02a09c755a575adb7e06696c3529883d398069210
SSDEEP

1536:EdiBvbidCStnvPmu4MIJCuYZEwL3AyZ79feApud:E0Did3tv+XMII5N1Z7l8d

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.8901551a89e53cfd4d134593c83225f0_JC.exe

Files

NEAS.8901551a89e53cfd4d134593c83225f0_JC.exe
.exe windows:4 windows x86

5e700186f1ba66c00aede2bcb0818f0c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteConsoleA
TzSpecificLocalTimeToSystemTime
HeapWalk
GetDiskFreeSpaceA
LeaveCriticalSection
GetFirmwareEnvironmentVariableExW
QuirkIsEnabledForPackage3Worker
Wow64DisableWow64FsRedirection
GetSystemWow64DirectoryA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE