NEAS[.]e13002821c8ae71b27ca651ae63bbf10_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.e13002821c8ae71b27ca651ae63bbf10_JC.exe
Size

1.9MB
MD5

e13002821c8ae71b27ca651ae63bbf10
SHA1

cabab62b0fd2b6ae06fa026d0686ea2a4b67cc1e
SHA256

c9cc0a681e7d273a4deb4cd24eca1073bc3f948ea30c23baa698bc31a518e7a3
SHA512

901ec2e49307af4fa206e5c4a2b2076edc179fa7b5d7cf8b8e7a76732a58cb54cb8fa82908bcfa255cc0846a895c60c6772612deb8b2aca2aedaa7bd0ae86827
SSDEEP

24576:hxGfBRzmRy3ia0REw4emHuyhCkCZhiplRBbafLrEtxVQB0on0yAhan:hxkBRzmRy3i7uw4emHuBTZwZsMtBy5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.e13002821c8ae71b27ca651ae63bbf10_JC.exe

Files

NEAS.e13002821c8ae71b27ca651ae63bbf10_JC.exe
.dll windows:4 windows x64

aefa5e2865ebd7628ff9ae47c736fa8f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

libiconv-2

libiconv
libiconv_close
libiconv_open
libiconv_set_relocation_prefix

kernel32

CloseHandle
CreateEventA
DeleteCriticalSection
EnterCriticalSection
EnumSystemLocalesA
GetACP
GetCurrentThreadId
GetLastError
GetLocaleInfoA
GetThreadLocale
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
MultiByteToWideChar
SetEvent
Sleep
TlsGetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte

msvcrt

___lc_codepage_func
___mb_cur_max_func
__iob_func
_amsg_exit
_assert
_errno
_initterm
_lock
_strdup
_unlock
abort
calloc
fputc
free
fwrite
getenv
iswctype
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
setlocale
strcat
strchr
strcmp
strcoll
strcpy
strerror
strlen
strncat
strncmp
strncpy
strrchr
strtoul
strxfrm
towlower
towupper
vfprintf
wcslen

libwinpthread-1

pthread_mutex_init
pthread_mutex_lock
pthread_mutex_unlock
pthread_mutexattr_destroy
pthread_mutexattr_init
pthread_mutexattr_settype
pthread_once

Exports

Exports

UC_CATEGORY_C
UC_CATEGORY_Cc
UC_CATEGORY_Cf
UC_CATEGORY_Cn
UC_CATEGORY_Co
UC_CATEGORY_Cs
UC_CATEGORY_L
UC_CATEGORY_LC
UC_CATEGORY_Ll
UC_CATEGORY_Lm
UC_CATEGORY_Lo
UC_CATEGORY_Lt
UC_CATEGORY_Lu
UC_CATEGORY_M
UC_CATEGORY_Mc
UC_CATEGORY_Me
UC_CATEGORY_Mn
UC_CATEGORY_N
UC_CATEGORY_Nd
UC_CATEGORY_Nl
UC_CATEGORY_No
UC_CATEGORY_P
UC_CATEGORY_Pc
UC_CATEGORY_Pd
UC_CATEGORY_Pe
UC_CATEGORY_Pf
UC_CATEGORY_Pi
UC_CATEGORY_Po
UC_CATEGORY_Ps
UC_CATEGORY_S
UC_CATEGORY_Sc
UC_CATEGORY_Sk
UC_CATEGORY_Sm
UC_CATEGORY_So
UC_CATEGORY_Z
UC_CATEGORY_Zl
UC_CATEGORY_Zp
UC_CATEGORY_Zs
UC_PROPERTY_ALPHABETIC
UC_PROPERTY_ASCII_HEX_DIGIT
UC_PROPERTY_BIDI_ARABIC_DIGIT
UC_PROPERTY_BIDI_ARABIC_RIGHT_TO_LEFT
UC_PROPERTY_BIDI_BLOCK_SEPARATOR
UC_PROPERTY_BIDI_BOUNDARY_NEUTRAL
UC_PROPERTY_BIDI_COMMON_SEPARATOR
UC_PROPERTY_BIDI_CONTROL
UC_PROPERTY_BIDI_EMBEDDING_OR_OVERRIDE
UC_PROPERTY_BIDI_EUROPEAN_DIGIT
UC_PROPERTY_BIDI_EUR_NUM_SEPARATOR
UC_PROPERTY_BIDI_EUR_NUM_TERMINATOR
UC_PROPERTY_BIDI_HEBREW_RIGHT_TO_LEFT
UC_PROPERTY_BIDI_LEFT_TO_RIGHT
UC_PROPERTY_BIDI_NON_SPACING_MARK
UC_PROPERTY_BIDI_OTHER_NEUTRAL
UC_PROPERTY_BIDI_PDF
UC_PROPERTY_BIDI_SEGMENT_SEPARATOR
UC_PROPERTY_BIDI_WHITESPACE
UC_PROPERTY_CASED
UC_PROPERTY_CASE_IGNORABLE
UC_PROPERTY_CHANGES_WHEN_CASEFOLDED
UC_PROPERTY_CHANGES_WHEN_CASEMAPPED
UC_PROPERTY_CHANGES_WHEN_LOWERCASED
UC_PROPERTY_CHANGES_WHEN_TITLECASED
UC_PROPERTY_CHANGES_WHEN_UPPERCASED
UC_PROPERTY_COMBINING
UC_PROPERTY_COMPOSITE
UC_PROPERTY_CURRENCY_SYMBOL
UC_PROPERTY_DASH
UC_PROPERTY_DECIMAL_DIGIT
UC_PROPERTY_DEFAULT_IGNORABLE_CODE_POINT
UC_PROPERTY_DEPRECATED
UC_PROPERTY_DIACRITIC
UC_PROPERTY_EMOJI
UC_PROPERTY_EMOJI_COMPONENT
UC_PROPERTY_EMOJI_MODIFIER
UC_PROPERTY_EMOJI_MODIFIER_BASE
UC_PROPERTY_EMOJI_PRESENTATION
UC_PROPERTY_EXTENDED_PICTOGRAPHIC
UC_PROPERTY_EXTENDER
UC_PROPERTY_FORMAT_CONTROL
UC_PROPERTY_GRAPHEME_BASE
UC_PROPERTY_GRAPHEME_EXTEND
UC_PROPERTY_GRAPHEME_LINK
UC_PROPERTY_HEX_DIGIT
UC_PROPERTY_HYPHEN
UC_PROPERTY_IDEOGRAPHIC
UC_PROPERTY_IDS_BINARY_OPERATOR
UC_PROPERTY_IDS_TRINARY_OPERATOR
UC_PROPERTY_ID_CONTINUE
UC_PROPERTY_ID_START
UC_PROPERTY_IGNORABLE_CONTROL
UC_PROPERTY_ISO_CONTROL
UC_PROPERTY_JOIN_CONTROL
UC_PROPERTY_LEFT_OF_PAIR
UC_PROPERTY_LINE_SEPARATOR
UC_PROPERTY_LOGICAL_ORDER_EXCEPTION
UC_PROPERTY_LOWERCASE
UC_PROPERTY_MATH
UC_PROPERTY_NON_BREAK
UC_PROPERTY_NOT_A_CHARACTER
UC_PROPERTY_NUMERIC
UC_PROPERTY_OTHER_ALPHABETIC
UC_PROPERTY_OTHER_DEFAULT_IGNORABLE_CODE_POINT
UC_PROPERTY_OTHER_GRAPHEME_EXTEND
UC_PROPERTY_OTHER_ID_CONTINUE
UC_PROPERTY_OTHER_ID_START
UC_PROPERTY_OTHER_LOWERCASE
UC_PROPERTY_OTHER_MATH
UC_PROPERTY_OTHER_UPPERCASE
UC_PROPERTY_PAIRED_PUNCTUATION
UC_PROPERTY_PARAGRAPH_SEPARATOR
UC_PROPERTY_PATTERN_SYNTAX
UC_PROPERTY_PATTERN_WHITE_SPACE
UC_PROPERTY_PRIVATE_USE
UC_PROPERTY_PUNCTUATION
UC_PROPERTY_QUOTATION_MARK
UC_PROPERTY_RADICAL
UC_PROPERTY_REGIONAL_INDICATOR
UC_PROPERTY_SENTENCE_TERMINAL
UC_PROPERTY_SOFT_DOTTED
UC_PROPERTY_SPACE
UC_PROPERTY_TERMINAL_PUNCTUATION
UC_PROPERTY_TITLECASE
UC_PROPERTY_UNASSIGNED_CODE_VALUE
UC_PROPERTY_UNIFIED_IDEOGRAPH
UC_PROPERTY_UPPERCASE
UC_PROPERTY_VARIATION_SELECTOR
UC_PROPERTY_WHITE_SPACE
UC_PROPERTY_XID_CONTINUE
UC_PROPERTY_XID_START
UC_PROPERTY_ZERO_WIDTH
_UC_CATEGORY_NONE
_libunistring_version
libunistring_amemxfrm
libunistring_c_isalnum
libunistring_c_isalpha
libunistring_c_isascii
libunistring_c_isblank
libunistring_c_iscntrl
libunistring_c_isdigit
libunistring_c_isgraph
libunistring_c_islower
libunistring_c_isprint
libunistring_c_ispunct
libunistring_c_isspace
libunistring_c_isupper
libunistring_c_isxdigit
libunistring_c_strcasecmp
libunistring_c_strncasecmp
libunistring_c_tolower
libunistring_c_toupper
libunistring_compute_curr_prefix
libunistring_freea
libunistring_fseterr
libunistring_gl_locale_name
libunistring_gl_locale_name_default
libunistring_gl_locale_name_environ
libunistring_gl_locale_name_posix
libunistring_gl_locale_name_thread
libunistring_gl_unicase_special_lookup
libunistring_gl_uninorm_decomp_chars_table
libunistring_gl_uninorm_decomp_index_table
libunistring_gl_uninorm_decompose_merge_sort_inplace
libunistring_glthread_once_multithreaded
libunistring_glthread_once_singlethreaded
libunistring_glthread_recursive_lock_init_multithreaded
libunistring_glwthread_mutex_destroy
libunistring_glwthread_mutex_init
libunistring_glwthread_mutex_lock
libunistring_glwthread_mutex_trylock
libunistring_glwthread_mutex_unlock
libunistring_glwthread_once
libunistring_glwthread_recmutex_destroy
libunistring_glwthread_recmutex_init
libunistring_glwthread_recmutex_lock
libunistring_glwthread_recmutex_trylock
libunistring_glwthread_recmutex_unlock
libunistring_glwthread_rwlock_destroy
libunistring_glwthread_rwlock_init
libunistring_glwthread_rwlock_rdlock
libunistring_glwthread_rwlock_tryrdlock
libunistring_glwthread_rwlock_trywrlock
libunistring_glwthread_rwlock_unlock
libunistring_glwthread_rwlock_wrlock
libunistring_hard_locale
libunistring_iconveh_close
libunistring_iconveh_open
libunistring_is_basic
libunistring_is_basic_table
libunistring_mb_copy
libunistring_mb_width_aux
libunistring_mbiter_multi_copy
libunistring_mbiter_multi_next
libunistring_mbiter_multi_reloc
libunistring_mbsnlen
libunistring_mem_cd_iconveh
libunistring_mem_iconveh
libunistring_mem_iconveha
libunistring_memcmp2
libunistring_mmalloca
libunistring_printf_frexp
libunistring_printf_frexpl
libunistring_relocate
libunistring_relocate2
libunistring_rpl_free
libunistring_rpl_frexp
libunistring_rpl_frexpl
libunistring_rpl_iswalnum
libunistring_rpl_iswalpha
libunistring_rpl_iswblank
libunistring_rpl_iswcntrl
libunistring_rpl_iswdigit
libunistring_rpl_iswgraph
libunistring_rpl_iswlower
libunistring_rpl_iswprint
libunistring_rpl_iswpunct
libunistring_rpl_iswspace
libunistring_rpl_iswupper
libunistring_rpl_iswxdigit
libunistring_rpl_malloc
libunistring_rpl_mbrtowc
libunistring_rpl_mbsinit
libunistring_rpl_strstr
libunistring_rpl_towlower
libunistring_rpl_towupper
libunistring_set_relocation_prefix
libunistring_setlocale_null
libunistring_setlocale_null_r
libunistring_str_cd_iconveh
libunistring_str_iconveh
libunistring_str_iconveha
libunistring_u16_casemap
libunistring_u16_is_invariant
libunistring_u16_possible_linebreaks_loop
libunistring_u16_printf_parse
libunistring_u32_casemap
libunistring_u32_is_invariant
libunistring_u32_possible_linebreaks_loop
libunistring_u32_printf_parse
libunistring_u8_casemap
libunistring_u8_is_invariant
libunistring_u8_possible_linebreaks_loop
libunistring_u8_printf_parse
libunistring_u8_width_linebreaks_internal
libunistring_u_printf_fetchargs
libunistring_uc_compat_decomposition
libunistring_uc_is_case_ignorable
libunistring_uc_is_cased
libunistring_uc_tocasefold
libunistring_ulc_printf_parse
libunistring_uniconv_register_autodetect
libunistring_unilbrk_is_all_ascii
libunistring_unilbrk_is_utf8_encoding
libunistring_unilbrk_table
libunistring_unilbrkprop
libunistring_uniwbrk_prop_index
libunistring_uniwbrk_table
libunistring_wcwidth
libunistring_xmax
libunistring_xsum
libunistring_xsum3
libunistring_xsum4
locale_charset
u16_asnprintf
u16_asprintf
u16_casecmp
u16_casecoll
u16_casefold
u16_casexfrm
u16_casing_prefix_context
u16_casing_prefixes_context
u16_casing_suffix_context
u16_casing_suffixes_context
u16_check
u16_chr
u16_cmp
u16_cmp2
u16_conv_from_encoding
u16_conv_to_encoding
u16_cpy
u16_cpy_alloc
u16_ct_casefold
u16_ct_tolower
u16_ct_totitle
u16_ct_toupper
u16_endswith
u16_grapheme_breaks
u16_grapheme_next
u16_grapheme_prev
u16_is_cased
u16_is_casefolded
u16_is_lowercase
u16_is_titlecase
u16_is_uppercase
u16_mblen
u16_mbsnlen
u16_mbtouc
u16_mbtouc_aux
u16_mbtouc_unsafe
u16_mbtouc_unsafe_aux
u16_mbtoucr
u16_move
u16_next
u16_normalize
u16_normcmp
u16_normcoll
u16_normxfrm
u16_possible_linebreaks
u16_possible_linebreaks_v2
u16_prev
u16_set
u16_snprintf
u16_sprintf
u16_startswith
u16_stpcpy
u16_stpncpy
u16_strcat
u16_strchr
u16_strcmp
u16_strcoll
u16_strconv_from_encoding
u16_strconv_from_locale
u16_strconv_to_encoding
u16_strconv_to_locale
u16_strcpy
u16_strcspn
u16_strdup
u16_strlen
u16_strmblen
u16_strmbtouc
u16_strncat
u16_strncmp
u16_strncpy
u16_strnlen
u16_strpbrk
u16_strrchr
u16_strspn
u16_strstr
u16_strtok
u16_strwidth
u16_to_u32
u16_to_u8
u16_tolower
u16_totitle
u16_toupper
u16_u16_asnprintf
u16_u16_asprintf
u16_u16_snprintf
u16_u16_sprintf
u16_u16_vasnprintf
u16_u16_vasprintf
u16_u16_vsnprintf
u16_u16_vsprintf
u16_uctomb
u16_uctomb_aux
u16_vasnprintf
u16_vasprintf
u16_vsnprintf
u16_vsprintf
u16_width
u16_width_linebreaks
u16_width_linebreaks_v2
u16_wordbreaks
u32_asnprintf
u32_asprintf
u32_casecmp
u32_casecoll
u32_casefold
u32_casexfrm
u32_casing_prefix_context
u32_casing_prefixes_context
u32_casing_suffix_context
u32_casing_suffixes_context
u32_check
u32_chr
u32_cmp
u32_cmp2
u32_conv_from_encoding
u32_conv_to_encoding
u32_cpy
u32_cpy_alloc
u32_ct_casefold
u32_ct_tolower
u32_ct_totitle
u32_ct_toupper
u32_endswith
u32_grapheme_breaks
u32_grapheme_next
u32_grapheme_prev
u32_is_cased
u32_is_casefolded
u32_is_lowercase
u32_is_titlecase
u32_is_uppercase
u32_mblen
u32_mbsnlen
u32_mbtouc
u32_mbtouc_unsafe
u32_mbtoucr
u32_move
u32_next
u32_normalize
u32_normcmp
u32_normcoll
u32_normxfrm
u32_possible_linebreaks
u32_possible_linebreaks_v2
u32_prev
u32_set
u32_snprintf
u32_sprintf
u32_startswith
u32_stpcpy
u32_stpncpy
u32_strcat
u32_strchr
u32_strcmp
u32_strcoll
u32_strconv_from_encoding
u32_strconv_from_locale
u32_strconv_to_encoding
u32_strconv_to_locale
u32_strcpy
u32_strcspn
u32_strdup
u32_strlen
u32_strmblen
u32_strmbtouc
u32_strncat
u32_strncmp
u32_strncpy
u32_strnlen
u32_strpbrk
u32_strrchr
u32_strspn
u32_strstr
u32_strtok
u32_strwidth
u32_to_u16
u32_to_u8
u32_tolower
u32_totitle
u32_toupper
u32_u32_asnprintf
u32_u32_asprintf
u32_u32_snprintf
u32_u32_sprintf
u32_u32_vasnprintf
u32_u32_vasprintf
u32_u32_vsnprintf
u32_u32_vsprintf
u32_uctomb
u32_vasnprintf
u32_vasprintf
u32_vsnprintf
u32_vsprintf
u32_width
u32_width_linebreaks
u32_width_linebreaks_v2
u32_wordbreaks
u8_asnprintf
u8_asprintf
u8_casecmp
u8_casecoll
u8_casefold
u8_casexfrm
u8_casing_prefix_context
u8_casing_prefixes_context
u8_casing_suffix_context
u8_casing_suffixes_context
u8_check
u8_chr
u8_cmp
u8_cmp2
u8_conv_from_encoding
u8_conv_to_encoding
u8_cpy
u8_cpy_alloc
u8_ct_casefold
u8_ct_tolower
u8_ct_totitle
u8_ct_toupper
u8_endswith
u8_grapheme_breaks
u8_grapheme_next
u8_grapheme_prev
u8_is_cased
u8_is_casefolded
u8_is_lowercase
u8_is_titlecase
u8_is_uppercase
u8_mblen
u8_mbsnlen
u8_mbtouc
u8_mbtouc_aux
u8_mbtouc_unsafe
u8_mbtouc_unsafe_aux
u8_mbtoucr
u8_move
u8_next

Sections

.text
Size: 375KB - Virtual size: 374KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aefa5e2865ebd7628ff9ae47c736fa8f

Headers

DLL Characteristics

File Characteristics

Imports

libiconv-2

kernel32

msvcrt

libwinpthread-1

Exports

Exports

Sections

.text Size: 375KB - Virtual size: 374KB

.data Size: 1KB - Virtual size: 1KB

.rdata Size: 1.4MB - Virtual size: 1.4MB

.pdata Size: 10KB - Virtual size: 10KB

.xdata Size: 11KB - Virtual size: 10KB

.bss Size: - Virtual size: 4KB

.edata Size: 23KB - Virtual size: 23KB

.idata Size: 3KB - Virtual size: 2KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 375KB - Virtual size: 374KB

.data
Size: 1KB - Virtual size: 1KB

.rdata
Size: 1.4MB - Virtual size: 1.4MB

.pdata
Size: 10KB - Virtual size: 10KB

.xdata
Size: 11KB - Virtual size: 10KB

.bss
Size: - Virtual size: 4KB

.edata
Size: 23KB - Virtual size: 23KB

.idata
Size: 3KB - Virtual size: 2KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB