NEAS[.]9cd0d083a3dc2b83bb7fa2b12ebe3e40_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.9cd0d083a3dc2b83bb7fa2b12ebe3e40_JC.exe
Size

1.2MB
MD5

9cd0d083a3dc2b83bb7fa2b12ebe3e40
SHA1

9a5216b621fa9329477919390bedc7dd0b668c26
SHA256

d550c3633f68473f53c83d333c0001525ef9fdcac5570eaa4b7c99cdd216b18c
SHA512

36c7428c5cf21112ea1a324d7ffd96c6eae07de50a2811b41988d2ecb65f35511b85c1942e1ee561d8f93e32bbcd48b1f193a2835b32ace941620128dbbfa679
SSDEEP

24576:DqAQELqTcg6UA2Q4NSEnBLX0qLqK2cL4xBsIJYGgSHOxe1PryWC1:mWeTNg4BnpNrxeepSHOxIz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.9cd0d083a3dc2b83bb7fa2b12ebe3e40_JC.exe

Files

NEAS.9cd0d083a3dc2b83bb7fa2b12ebe3e40_JC.exe
.exe windows:4 windows x86

c7f600a767a26791986f04432449c394

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

CreateStreamOnHGlobal

comctl32

ImageList_GetImageInfo

shell32

ShellExecuteA

comdlg32

GetSaveFileNameA

Sections

CODE
Size: 1.1MB - Virtual size: 4.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE