NEAS[.]952d9af3370fab02e3e071bd0a4f85e0_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.952d9af3370fab02e3e071bd0a4f85e0_JC.exe
Size

119KB
MD5

952d9af3370fab02e3e071bd0a4f85e0
SHA1

43d526c59b07223a4eec1b691ffada46e9b3c845
SHA256

9a917a78e83899f300fcef2626c7b969fd8d30bc435c3052d8e7db36b8a63472
SHA512

887ba64dd5ebae1a7d240ffc0c7964afcbb7911267a3076a43e33542acf9bdfbbe72ba6f3e53929acd9686c522f9ae00911b5857be29e65c6be34a0494cc15f7
SSDEEP

3072:pU4gGggxmup8VvZi+wtOiDwYBnGHhYQElqwk:pyGxpCv8+4OawCGDElqz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.952d9af3370fab02e3e071bd0a4f85e0_JC.exe

Files

NEAS.952d9af3370fab02e3e071bd0a4f85e0_JC.exe
.exe windows:4 windows x86

e4ff8d8a6d51e2f8c6a657c191d62b09

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetConsoleCommandHistoryA
GetErrorMode
K32GetPerformanceInfo
EnumResourceNamesExW
SetMessageWaitingIndicator
TlsGetValue
CopyContext
RemoveSecureMemoryCacheCallback
DeleteFiber
ReadConsoleA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE