NEAS[.]f3cc50110c18448d1b3e6d659d908a50_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.f3cc50110c18448d1b3e6d659d908a50_JC.exe
Size

119KB
MD5

f3cc50110c18448d1b3e6d659d908a50
SHA1

34d46d07f24ffa4f04776b74ee37f59516448ba9
SHA256

71e9b44bba006e038f8769f6fa3bb240de42b90e5fbc3b98c776e5e9ea3b082b
SHA512

35499dfa8913ad96158bf38d49b9d57951bfc631c9e3c44a2ce07f2e640147d3e5a949031ee2363c89da11e38e1a048a7372ac6a43be15caedfd18afd0362705
SSDEEP

3072:d74mBkczLAD2j7ibXP6AV5oVnEUxQs+hO:RJ9P7HibLVeEUWdO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.f3cc50110c18448d1b3e6d659d908a50_JC.exe

Files

NEAS.f3cc50110c18448d1b3e6d659d908a50_JC.exe
.exe windows:4 windows x86

51cc1e7e7d2faaab235e904f9caf6cbc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

NlsEventDataDescCreate
EnumResourceTypesExW
WerRegisterMemoryBlockWorker
GetQueuedCompletionStatus
PssQuerySnapshot
IsCalendarLeapYear
FreeEnvironmentStringsA
IdnToNameprepUnicode
DnsHostnameToComputerNameExW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE