NEAS[.]6b15ef685e71228811f3e2161c80b720_JC[.]exe | Triage

Sharing

General

Target

NEAS.6b15ef685e71228811f3e2161c80b720_JC.exe
Size

181KB
MD5

6b15ef685e71228811f3e2161c80b720
SHA1

1c0b7d1926f48c36da20f12ec862854b3ac89da3
SHA256

0d9c73c8ddae3361af41d7e0ab580cc5a4db496f5061ca18650991cccfe01218
SHA512

4ced53b56dfdc84421686a4b3e01134900526e4c054922ab45793a32e7bf33263f497cb36e707516bf08232e3ae352c46f16625bc9ac0ba127ceeab83d4c98f4
SSDEEP

3072:Qp1TFlDFNv3I8uL+C0Z5L5cX2AJXwemr9+yQ1:yJ17vT5B3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.6b15ef685e71228811f3e2161c80b720_JC.exe

Files

NEAS.6b15ef685e71228811f3e2161c80b720_JC.exe
.exe windows:4 windows x86

ab2f9439ae80998bbf4d9e091d8cf3a0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm50

MethCallEngine
ord516
ord519
ord660
ord301
ord595
ord598
ord520
ord307
ord523
ord524
ord631
ord525
ord632
ord526
EVENT_SINK_AddRef
ord527
ord529
ord560
DllFunctionCall
ord670
EVENT_SINK_Release
ord600
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord606
ord607
ord608
ord609
ProcCallEngine
ord535
ord536
ord537
ord645
ord648
ord570
ord573
ord681
ord577
ord685
ord100
ord610
ord611
ord613
ord616
ord617
ord618
ord542
ord650
ord652
ord545
ord546
ord581

Sections

.text
Size: 171KB - Virtual size: 171KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 632B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ