NEAS[.]6e147a643a13373e57ff8e5e19395880_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.6e147a643a13373e57ff8e5e19395880_JC.exe
Size

119KB
MD5

6e147a643a13373e57ff8e5e19395880
SHA1

e32ad3e4fdfb371334c4655041eb734eb7d4de57
SHA256

1987bc44aa24832b757936260efb9237fdd054b487da57b4594f15138a631337
SHA512

7c1d1167cb2af0a485f57d925dd3138b1bc2f4f17d242e0d8e6fd6d1941c311b51eb0bbf6aff8c701dd0fdf6e09454927db57efc4d3d00a699823f120e6a7645
SSDEEP

3072:4sSKRM7VVdEfjMHqggHUXPqUX/uncZ2Iae1uoJcRHyNxI1H:4sSIMNEfbl0XPqUv6Iv1uUcRHy4H

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.6e147a643a13373e57ff8e5e19395880_JC.exe

Files

NEAS.6e147a643a13373e57ff8e5e19395880_JC.exe
.exe windows:4 windows x86

685324d082cc08ab95c17bd7608e984a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WerpLaunchAeDebug
LZCloseFile
GetModuleHandleA
CreateBoundaryDescriptorA
GetComputerNameW
BasepQueryModuleChpeSettings
PeekNamedPipe
CreateDirectoryW
WerUnregisterMemoryBlockWorker
SetFileShortNameW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE