NEAS[.]6a7582ed82b4d9aeaffde10824be7300_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.6a7582ed82b4d9aeaffde10824be7300_JC.exe
Size

464KB
MD5

6a7582ed82b4d9aeaffde10824be7300
SHA1

a1fb7f05a64ffd064359ce24a43989a6cc7e6998
SHA256

e62191fd754c505c75e50ff37da2b4648f913f39406b1967d88c6f55a76443fa
SHA512

cc3239cfd80375edb947931a512603e41a847682c5898b9395838ccef85ec239fae4bad09d1e0962bbc544a9346ead57f9424b469dc82dd88d6fd322912d2b21
SSDEEP

6144:usR4QIET+R0SY8TbbIqM55bEtR9f23Gn2opJsWXDmEx8cdmG/ErdMc2bKlc84:V4PRk8D0BEtL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.6a7582ed82b4d9aeaffde10824be7300_JC.exe

Files

NEAS.6a7582ed82b4d9aeaffde10824be7300_JC.exe
.exe windows:4 windows x86

4ffd5d04ef7e1f9eab8a62c65d3dbe0e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_NO_BIND

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetModuleHandleA
GetProcAddress

user32

CharNextA

advapi32

RegCloseKey

oleaut32

SysFreeString

version

VerQueryValueA

gdi32

SaveDC

ole32

CoInitialize

comctl32

ImageList_Add

shell32

SHGetPathFromIDListA

Sections

.MPRESS1
Size: 158KB - Virtual size: 484KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE