NEAS[.]78840873767f13d58cdc268016632670_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.78840873767f13d58cdc268016632670_JC.exe
Size

285KB
MD5

78840873767f13d58cdc268016632670
SHA1

2acbe44484eaa488743ea43327b2ee4ab979baba
SHA256

330f3841d6392c278b804fcb259336ed7fc90b7b8439afd0dd9adf7e42a6e298
SHA512

5be52dc0599b6e8c04520b5e9410fb4782f18bab351f5b719eb78d741dbe91b19f2399bfd30243079d8f17854d816fd2d9fbac75266372acddac31ff10445eba
SSDEEP

6144:RbiKbwync8pbD54ccP75PATl4HJF2VeY+eRLcDCOtNugEetEIrqp:1iYwyncK3XU2l4pF2VeYDOtNugEetEIK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.78840873767f13d58cdc268016632670_JC.exe

Files

NEAS.78840873767f13d58cdc268016632670_JC.exe
.exe windows:5 windows x86

999a42947a1eb4861dfe28d24d12f311

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

LoadAcceleratorsW

advapi32

RegSetValueExW

shell32

ShellExecuteA

ws2_32

WSAStartup

iphlpapi

GetAdaptersAddresses

Sections

.text
Size: 278KB - Virtual size: 392KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE