NEAS[.]963a1637f4d794ada4c93785d4709df0_JC[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.963a1637f4d794ada4c93785d4709df0_JC.exe
Size

292KB
MD5

963a1637f4d794ada4c93785d4709df0
SHA1

a425510463a97dcce37732a6be8191d8297dde67
SHA256

c4d35ef2cb0b9acfbaa195fa2fa933993b3f4e35185fdb15e21074db42b45c9c
SHA512

9c2e68cfafbb8f973cb1a39990f327ef0dafdd3c660d8c45d95190cac31272cef10d42ae359f799ebcaed1b8f72fc767c516f69d81f519b4f50483859ae0bfcb
SSDEEP

6144:ZE6aAW6SNSHWq/buDtbgTjHfkrZByBp1hM3yG:baAW6cS2qjusavyDfG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.963a1637f4d794ada4c93785d4709df0_JC.exe

Files

NEAS.963a1637f4d794ada4c93785d4709df0_JC.exe
.dll windows:4 windows x86

1546f99fec9d9abb887acf56e8835a4d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileW
CreateThread
GetTickCount
SystemTimeToFileTime
InterlockedDecrement
InterlockedIncrement
LoadLibraryW
GetModuleFileNameW
LocalFree
CreateEventW
SetEvent
Sleep
LeaveCriticalSection
EnterCriticalSection
ResetEvent
OpenEventW
UnmapViewOfFile
RaiseException
MapViewOfFile
CreateFileMappingW
lstrcpynA
lstrlenA
MultiByteToWideChar
IsBadReadPtr
SetWaitableTimer
CancelWaitableTimer
GetLastError
CreateWaitableTimerW
OpenWaitableTimerW
InitializeCriticalSection
DeleteCriticalSection
OpenMutexW
GetModuleHandleA
ExitProcess
DisableThreadLibraryCalls
FreeLibraryAndExitThread
TerminateThread
GetVersionExW
GetCurrentThread
lstrcatA
GetSystemTimeAsFileTime
lstrcmpiW
lstrcmpW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
SetFilePointer
OutputDebugStringA
SetEndOfFile
WriteFile
VirtualProtect
SetLastError
lstrcmpiA
lstrcpyA
GetVolumeInformationW
GetSystemWindowsDirectoryW
FindClose
FindNextFileW
FindFirstFileW
GetSystemTime
GetCurrentProcessId
WaitForMultipleObjects
FlushFileBuffers
CreateDirectoryW
RemoveDirectoryW
DeleteFileW
VirtualQuery
Thread32Next
Thread32First
SuspendThread
ResumeThread
OpenThread
GetLongPathNameA
GetSystemInfo
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetFileSize
ReadFile
WideCharToMultiByte
MoveFileW
lstrcatW
GetLocalTime
ReleaseMutex
CreateMutexW
WaitForSingleObject
GetCurrentProcess
lstrcpyW
FreeLibrary
lstrlenW
lstrcpynW
CreateProcessW
CloseHandle
SetErrorMode
GetFileAttributesW
LoadLibraryA
GetProcAddress
OutputDebugStringW
GetUserDefaultLCID
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleFileNameA
GetStdHandle
GetOEMCP
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
HeapSize
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStringTypeW
GetStringTypeA
GetCPInfo
LCMapStringW
LCMapStringA
GetProcessHeap
GetCommandLineA
GetCurrentThreadId
HeapReAlloc
HeapAlloc
HeapFree
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange

user32

DispatchMessageW
PeekMessageW
BroadcastSystemMessageW
MsgWaitForMultipleObjectsEx
IsCharAlphaW
IsCharAlphaNumericW
UpdateWindow
SendMessageW
FindWindowExW
wsprintfW
SetWindowTextW
UnregisterClassA
SetForegroundWindow
TranslateMessage
AllowSetForegroundWindow
wsprintfA
LockSetForegroundWindow
SetWindowsHookExW
PostMessageW
MsgWaitForMultipleObjects
CallNextHookEx
UnhookWindowsHookEx
EnumChildWindows

advapi32

DuplicateTokenEx
SetNamedSecurityInfoW
RegQueryInfoKeyW
RegEnumValueW
RegCreateKeyExW
RegFlushKey
RegNotifyChangeKeyValue
ImpersonateSelf
OpenProcessToken
GetLengthSid
SetTokenInformation
SetThreadToken
RegDeleteValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityInfo
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegCloseKey

shell32

ord680
SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

OleRun
CoCreateInstance
CoUninitialize
CoGetInterfaceAndReleaseStream
CoInitializeEx
CoMarshalInterThreadInterfaceInStream
CoTaskMemFree
StringFromCLSID
CoCreateGuid
CoFreeUnusedLibraries

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear
SysStringLen
DispCallFunc
LoadRegTypeLi
LoadTypeLi
SysAllocStringByteLen
SysStringByteLen
VariantCopy
GetErrorInfo
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SysAllocStringLen

shlwapi

UrlEscapeW
StrStrIA
StrRStrIW
StrCmpNW
UrlUnescapeW
StrStrIW

ntdll

RtlZeroMemory
RtlUnwind

Exports

Exports

Startup
e
l
r

Sections

.text
Size: 180KB - Virtual size: 179KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1546f99fec9d9abb887acf56e8835a4d

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

ntdll

Exports

Exports

Sections

.text Size: 180KB - Virtual size: 179KB

.rdata Size: 48KB - Virtual size: 45KB

.data Size: 12KB - Virtual size: 37KB

.reloc Size: 16KB - Virtual size: 15KB

.text
Size: 180KB - Virtual size: 179KB

.rdata
Size: 48KB - Virtual size: 45KB

.data
Size: 12KB - Virtual size: 37KB

.reloc
Size: 16KB - Virtual size: 15KB