NEAS[.]be5b6f70d5b0659ea0cf32c85715b6d0_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.be5b6f70d5b0659ea0cf32c85715b6d0_JC.exe
Size

119KB
MD5

be5b6f70d5b0659ea0cf32c85715b6d0
SHA1

51db7ad1f2d80c4d8daf9f5778028203f574d34d
SHA256

8f880e43d8ae03d16d63f154ade7f6f66fb5c3fbde9c3b5d583eda6c0d72dc48
SHA512

27b380a092874668605fac5cd23d3c46dbb89b324cfd88415fa7f56cbff09901ec30e0a84dfda08f355a2c655d1e63e1f82b46065fbbd4c143942400881237a6
SSDEEP

3072:FXGSC70pWYLaGcQLhv63C+iG/mHQ8P3r2BX7t:/CIpHa0veC+iG/oP3r21t

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.be5b6f70d5b0659ea0cf32c85715b6d0_JC.exe

Files

NEAS.be5b6f70d5b0659ea0cf32c85715b6d0_JC.exe
.exe windows:4 windows x86

b1edf6e7c53e994bbe5ff6ae0a4b8e2e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessAsUserA
EnumerateLocalComputerNamesA
GetThreadInformation
TermsrvOpenUserClasses
QuirkIsEnabledForPackageWorker
HeapDestroy
VirtualAllocExNuma
GetComputerNameExW
FindFirstFileExW
GetVolumePathNamesForVolumeNameA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE