NEAS[.]b98b1775517e128fc8d17733e412ce70_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.b98b1775517e128fc8d17733e412ce70_JC.exe
Size

445KB
MD5

b98b1775517e128fc8d17733e412ce70
SHA1

ba2982daeeadafb1f7b0a5b0dd05b758b70ec061
SHA256

a667fb4c4f8b11097156dcd469ef15574e7034376799ca6817e52a3e5d32f6e1
SHA512

58e3f1eb1069a60a80c96c1ed5c933cebb237f381ad5cfda2758ab3a742ced4cf0095e2051c6d47f4544fb358a76ecf4a3422a454696cffb71dbadb048d61c12
SSDEEP

12288:/IECkvP2mjeSM/53F9F1RnNI5n9NHlgNTcO3:uYPRc/53F9F1RnNon/HyTcO3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.b98b1775517e128fc8d17733e412ce70_JC.exe

Files

NEAS.b98b1775517e128fc8d17733e412ce70_JC.exe
.exe windows:6 windows x86

0d8166ab35934c676799e953657deaf0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

vcruntime140

__telemetry_main_return_trigger
__telemetry_main_invoke_trigger
memcpy
strrchr
_except_handler4_common
memset

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode
__stdio_common_vsscanf
__acrt_iob_func
__stdio_common_vsprintf
fwrite
fseek
fread
fopen
fflush
fclose
puts
__stdio_common_vfprintf

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_exit
_errno
_initterm
_get_initial_narrow_environment
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_narrow_environment
_set_app_type
__p___argc
_initialize_onexit_table
_configure_narrow_argv
_crt_atexit
_controlfp_s
terminate
_seh_filter_exe
__p___argv
_register_onexit_function
exit

api-ms-win-crt-filesystem-l1-1-0

_stat64i32

api-ms-win-crt-heap-l1-1-0

free
malloc
realloc
calloc
_set_new_mode

api-ms-win-crt-string-l1-1-0

strncmp

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

kernel32

SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
UnhandledExceptionFilter

Sections

.text
Size: 385KB - Virtual size: 384KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 197KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0d8166ab35934c676799e953657deaf0

Headers

DLL Characteristics

File Characteristics

Imports

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

kernel32

Sections

.text Size: 385KB - Virtual size: 384KB

.rdata Size: 42KB - Virtual size: 42KB

.data Size: 2KB - Virtual size: 197KB

.gfids Size: 512B - Virtual size: 32B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 13KB - Virtual size: 13KB

.text
Size: 385KB - Virtual size: 384KB

.rdata
Size: 42KB - Virtual size: 42KB

.data
Size: 2KB - Virtual size: 197KB

.gfids
Size: 512B - Virtual size: 32B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 13KB - Virtual size: 13KB