�^`�y�y�AO.T�o�������WG��E6вB���6���i#�>%G�dز�Ha�iR��)� pb���%1�`]������V�\�߆=K�\��mUG�$�)9��j�A�V��~����-�_��N�����~����hG��(��8��h�y�(.�ɐ��t�cv�~vͩ é���49%�o[� ǜ0,�U@�Qf��L�Y�������ޥL1Cey:�.x[����<�Ƿa��V���T�"��ڲsA�h(�R@jH�8;Tv������mB���!���4R,�o���/�RA+Pٹ{i\�+s��.�F����\�����^��Xd����Դ(�|qPh��.3�E76`[�,���`YA���>:�!b���XsƸ��(u���|(��<��dw��j\J4N8�'_�[Rn�v��s��a���Kn��U�f!�:QF�U H��l.�Ka�K*^D��F\_Z%5���JG"x�!�D�X?fA��M���b�-�*��?P�6������WG�U��m��v�yGѲ �+yà�g;S��,�/cj�H��}�?. ej!.!�����p5B�Z�'��ur�L�<�F>��o���1�n�i�A�t� �t�'�#����«�����r{A�A�Y5�ݰ���d,����s�п�w]&;%���)b��bE�tE" �Z��蜳e�&46�`6�;�,���:�u��JKF/�S��;���Dn3i��f�D��D0cO�g�I�$���ɧ@e>U{u�Ȃ�=-n�-'We*��ۗ 䜓'7��D��Z`��E�M������-&x ��[���O��f>����ʼ�lm��iO�=3�$��V)��o���a���!�~RIpv��U���|��k�(X$�Xܤ�?d����Q����Ar쓹e��n/3�>��w���:: �����;��J���@ ������36�����nǑ��V�Gǁ�k����NXG�q���d%�Js�hl�<R��^�"���ɮώ}�[i6SS.��t�� ٥��a���7�$���2��=�N��S8���;x���\���v��s���J�Z-�CtY�W;<����A�Y@j�i(��[�dY��W;װ��q��y������k.��.;_Kn����b�/Gd���+��4�]l�V*�Ư�����E����;�{A/���)�Q�"9�����6��c���-��V�*���Oa̗ ����\����ESwp{�g���|��v�����)�`����MS����\h\�S��l�M9v�\�1g� �@��Ɓjk�>���cJ����0FUhN���d`q1�<yq���qh =�c������O�;��@9)�%�������$ui��z�n_1{J�ʇ�9[��*����5�+E��m���+��c�fu�xV?����w�BM�Pm�\�_r�!�o�"(F<��m:H:݁�aq�R��?����!�QX��D\:�0Q�mh �X�UjMi�D"�`'��ŕ��c���e`i�ރ*�{�*_ɰ�)��|Xx�?�(ep�IQ�77��8?"P����b|�?j�U��pf�Z{#'`�:ٴ����F�q�t����cXM��IS��@�a�ԥ�>,�w&���M�����6�[�1k���DN�Rh �La�۳6$2NphM����� n7��K5� ��EM�:l"� �-��y7��V����0�,������D|���o�:�k��?���������I$5��`"��<�� "��ZT�9�,7�P�3�J�N{&�c���'h������J �b��E��-�]U�N.k�w�J!E���lptf�#���Њ��8A��FoF`���m:y�JɻB����CԬ�OE{��OÓǸ[��&�I;Ы���܈\�8r�4�LB[=a��n���+�i�;c}\H�U:���A�]���oV�K��� ܖ�R��d�%~��3[���:�a�Å����4S��&l��[��n��OB��t���$8=@����ib��Q��������8�"��3�Ŭ�����q�`��A�%�����U�H�N�%�1��C�f7��`�+=߀�X,nb�|-���de� N E��N��&]�������`ho���ۛ�g4�����!����@���*�����m*�VNzGRA�\0qEE@9n[� ��sr�t>%��R�E��@ד:����J�B7�!B�� Smva�P9鐁D�wy�=7����'�o�V$0�.��Ʌ��n�q�R *��*�AKj�s�0�ɇpL�˘b�;�ΖMߏ�"2-�u�7S(����Z�(�H^� >�&�K��Q����!I^L�0r�|<i j[ �4m��ތ��`�r�b9ߎ֙����Ty�1N�;`S�_��t�L;I����~XQ%�+�'�P�܀�p�!�����3V��D� �B�Ue�OV~�-��8�xЀ�ZgJ���%�b2��>]��(<W�V�x)� WEDx��Kg�����a/���w��<�_�G*2�Z�3�&iW.,0{($n9��e�[�be���p���<�ѷ����Kf,�I��������B7�J@S�z���:�%B�裑Z�[�ݏ��[!�>�I���m�qn�'�5 ���C{�� ��$�>(��#�y���`�ӥ�e,�y�9O�}U�'��zkK�e*>zu�[dbaQ5�݁]�0�\�~��o|.N��IIۛ#�sN���/+��|���7��x�Ԉr(M�U���F�P �Wɑ�th�#����(c�dx��3+Z���FI*cv�XS�� ���?R��;��l������o��>@o֨%�!���o���Q����i @��mu}m��Mf�(ɖ�gL��p��x����M�>K��B�EP�_���U�7�ܻC�)ޓ�ȲEO�Gp*�����U W��@�8F�}xNXF%�@;�r�3|~Ȋy�u� ��T�R,1>Ev �����E�j�>�����0Zp��:F(~�z��@�o;�vm6Tv�*��N�E��� W��x^4����6ۖhs�P����NG�x���}��Z$u�}dB�e2�z>RlyN�U^�K
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.45b3cf803ca0b475d4148b3f694fde10_JC.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.45b3cf803ca0b475d4148b3f694fde10_JC.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.45b3cf803ca0b475d4148b3f694fde10_JC.exe
-
Size
7.5MB
-
MD5
45b3cf803ca0b475d4148b3f694fde10
-
SHA1
7d4ff26992edc527837761cfdafa6b1b21d9d5f0
-
SHA256
f1d7dea668d083a3d76dd0f7fcf23a69901eb5200a43b9b2a3dd847360bc54b4
-
SHA512
dca12e0ae52757493a6860735194d8c7b7e3899d7d04cdef381b6001d53b82ca37a073b390be03e37812b6cb6312992849f23235f475e31c8ff1cd83d5413f9f
-
SSDEEP
196608:hMz3hnztw0aWV0ICyYN5TaukLpEhof7P5xjMmbl5ctz:uz3xi0aWVsyY3TH6pEhof7RxRl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.45b3cf803ca0b475d4148b3f694fde10_JC.exe
Files
-
NEAS.45b3cf803ca0b475d4148b3f694fde10_JC.exe.exe windows:4 windows x86
f38958738dd68b15635509bd660a5980
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutClose
ws2_32
__WSAFDIsSet
rasapi32
RasGetConnectStatusA
kernel32
FindClose
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetSubMenu
MessageBoxA
gdi32
RoundRect
winspool.drv
DocumentPropertiesA
advapi32
RegQueryValueA
shell32
SHGetSpecialFolderPathA
ole32
CoFreeUnusedLibraries
oleaut32
SafeArrayUnaccessData
comctl32
ImageList_DragLeave
oledlg
ord8
wininet
InternetCloseHandle
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CODE Size: - Virtual size: 330KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 508KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text0 Size: 74KB - Virtual size: 73KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text1 Size: - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text2 Size: 7.3MB - Virtual size: 7.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 74KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ