InHook
UnHook
Behavioral task
behavioral1
Sample
NEAS.1e1ebc7e1517d5410902b988c9a0cdb0_JC.dll
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.1e1ebc7e1517d5410902b988c9a0cdb0_JC.dll
Resource
win10v2004-20231023-en
Target
NEAS.1e1ebc7e1517d5410902b988c9a0cdb0_JC.exe
Size
34KB
MD5
1e1ebc7e1517d5410902b988c9a0cdb0
SHA1
f1641f131d1e0323a50289f28b0cbd7352a5fc78
SHA256
7645311c83bb9e426509841b243906758d1ea74282fbbe15dd2a70cba8d8c2c5
SHA512
0c5165e248ba340a70ee973ccf19de3e7f7080f74e013d91c67b3c84c85de88f52ab1ccdc09fc5f937a91657a8fda0440823ec5831318b0941d6b55726841736
SSDEEP
768:+Bu3Jh73/Z0kXmFsD+8aOP7pLEWqN7TG:eu3JFykXmDeLVqF
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
NEAS.1e1ebc7e1517d5410902b988c9a0cdb0_JC.exe |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetModuleHandleA
MultiByteToWideChar
lstrlenA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
TerminateProcess
CallNextHookEx
GetWindowThreadProcessId
FindWindowA
SetWindowsHookExA
UnhookWindowsHookEx
SysFreeString
SysAllocStringLen
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
free
??3@YAXPAX@Z
memcpy
InHook
UnHook
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ