NEAS[.]ddd081b187e0fbe6bef31f162eb8c720_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.ddd081b187e0fbe6bef31f162eb8c720_JC.exe
Size

146KB
MD5

ddd081b187e0fbe6bef31f162eb8c720
SHA1

b071fe1e8ec65a82d8fa474515bc95be911613e9
SHA256

00971ac651d43712843e323f71f11f53760b9284991e91a9d8f767a803bfe53e
SHA512

e7bad573ae8ff186c8334f9ac4e97dadbd5fed18121dda2076bf646f30b24d78c1ec64934e290514f3aa1e521d7006a9efbd5cbd7a3032b3ff4a2bffd90e009a
SSDEEP

1536:AnbcF56LkSudjDThPlVwf5SiKRkdflA682DVsm9c6o1jIc+bxeMjmUd2T4iS7b7u:l2khPlw5gRG0sG6o1sNwMjJ8TtSX7u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.ddd081b187e0fbe6bef31f162eb8c720_JC.exe

Files

NEAS.ddd081b187e0fbe6bef31f162eb8c720_JC.exe
.exe windows:1 windows x86

8eb8e4b59586cb66b4c63ac3fe628e44

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CryptBinaryToStringW

kernel32

GetProcAddress
LoadLibraryA
RtlUnwind
VirtualProtect
GetModuleHandleW
GetLastError
GetCommandLineW
GetStdHandle
MultiByteToWideChar
GetFileType

shlwapi

PathAppendA

crtdll

__GetMainArgs
exit
raise
signal

ntdll

wcscat

user32

LoadStringW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 40B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 127KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 916B - Virtual size: 916B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 268B - Virtual size: 268B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ