NEAS[.]b53aacd434493cbd213595a0696dc720_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.b53aacd434493cbd213595a0696dc720_JC.exe
Size

131KB
MD5

b53aacd434493cbd213595a0696dc720
SHA1

28fbac84006ef30450fe20aa5676196ceeeb8b45
SHA256

86998d22f3e40aa743eabe3401ccc14dc50230e269cd24af7a165971daee2cb1
SHA512

d13beb82c2a8fb92003611a78bc462978e1cd69f4d6ac8db926ad85e19e724db7d03e6bf9a19252faeaa9b7eb90c9e9d1e434284203bd5adba2bc1cedb3a88ef
SSDEEP

3072:Dr6ixvEtCSYJ2DjPOrxwUxqLqXQhWGm+HeQBPqd1voi8f:DxEtCSYJ2fmwUxGUQByAi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.b53aacd434493cbd213595a0696dc720_JC.exe

Files

NEAS.b53aacd434493cbd213595a0696dc720_JC.exe
.dll windows:6 windows x64

2c0f64a1270ea0aebe3f33b34754c5f1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

sbiedll

SbieApi_QueryProcessInfo
SbieDll_Hook

psapi

EnumProcesses

kernel32

GetModuleHandleW
CreateMutexW
CloseHandle
GetProcessId
HeapDestroy
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
GetLastError
lstrcmpiW
GetModuleFileNameW
OpenProcess
GetProcAddress
InitializeCriticalSectionAndSpinCount
RaiseException
DeleteCriticalSection
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
SetFilePointerEx
GetConsoleMode
CreateFileW
WriteConsoleW
LocalFree
SetLastError
GetConsoleOutputCP
WriteFile
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
InterlockedFlushSList
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetCurrentProcess
TerminateProcess
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualQuery
ExitProcess
GetModuleHandleExW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
GetFileType
GetStringTypeW
SetStdHandle
FlushFileBuffers

advapi32

GetTokenInformation
IsValidSid
GetLengthSid
CopySid
ConvertSidToStringSidW

userenv

UnloadUserProfile

Exports

Exports

InjectDllMain

Sections

.text
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2c0f64a1270ea0aebe3f33b34754c5f1

Headers

DLL Characteristics

File Characteristics

Imports

sbiedll

psapi

kernel32

advapi32

userenv

Exports

Exports

Sections

.text Size: 74KB - Virtual size: 73KB

.rdata Size: 43KB - Virtual size: 42KB

.data Size: 3KB - Virtual size: 7KB

.pdata Size: 5KB - Virtual size: 5KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 74KB - Virtual size: 73KB

.rdata
Size: 43KB - Virtual size: 42KB

.data
Size: 3KB - Virtual size: 7KB

.pdata
Size: 5KB - Virtual size: 5KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB