NEAS[.]e505ff4fa82b49a4de2087a499263d50_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.e505ff4fa82b49a4de2087a499263d50_JC.exe
Size

119KB
MD5

e505ff4fa82b49a4de2087a499263d50
SHA1

81d027e1150b0e92233849b0beb3898687f85fba
SHA256

a4ebef77c3124e4c1e139664054e5825058b2334f081c52a5809d3a0b5ed8245
SHA512

2d0b85352d5d17516408085b05d370a29e12c03f4f82f172a8c80d81458c4dd7669eb42f1f7ac2e4f9f268d7cc0112b46359b15764dd4e1bd373b124a4544a30
SSDEEP

3072:Ed69brZhDCCyj8EKDtZFJej7k7G8OrRNKAdXKo6:EQbzGCR/BlE47cRD6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.e505ff4fa82b49a4de2087a499263d50_JC.exe

Files

NEAS.e505ff4fa82b49a4de2087a499263d50_JC.exe
.exe windows:4 windows x86

629bdb68fdfe792419d9aefa2242a970

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

BaseInitAppcompatCacheSupport
PackageNameAndPublisherIdFromFamilyName
GetSystemDefaultLangID
VirtualAlloc
SetSystemTimeAdjustment
VerLanguageNameW
lstrcmpi
RegCopyTreeW
PssWalkSnapshot
GlobalFindAtomW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE