NEAS[.]30d15ee9f2f27ed1898bd19461232880_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.30d15ee9f2f27ed1898bd19461232880_JC.exe
Size

367KB
MD5

30d15ee9f2f27ed1898bd19461232880
SHA1

21730fa49d859919b0b79b58d22bb7d57dcf4ec7
SHA256

6e541ad4454a6d328b3614e8c96731110547402a28566513bb2c9334f56954d2
SHA512

69191662fc5021ec54464829fa69570aead7cda3097b22e71128294b46e4433e827ca7aa095045ca803740a87bcbec8cddc129241edbfba4d138e30532c2078d
SSDEEP

6144:/dmkVgldhM+EGqkaHKEfHJQUbSq96BYEaBMT0xJslipNs/1Jbf6/uvr:/dklwlqEhQKbQB5gMQxJhu1Jbi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.30d15ee9f2f27ed1898bd19461232880_JC.exe

Files

NEAS.30d15ee9f2f27ed1898bd19461232880_JC.exe
.exe windows:4 windows x86

f6fc559af571215852f18beef2cbcd17

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

wsock32

__WSAFDIsSet

version

GetFileVersionInfoSizeA

winmm

waveOutSetVolume

comctl32

ImageList_DragEnter

mpr

WNetCancelConnection2A

user32

GetSubMenu

gdi32

Ellipse

comdlg32

GetSaveFileNameA

advapi32

LookupPrivilegeValueA

shell32

DragQueryPoint

ole32

OleSetContainedObject

oleaut32

VariantTimeToSystemTime

Sections

.text
Size: 204KB - Virtual size: 544KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE