NEAS[.]1f1815eaa1841cc1fb9f1410e1052ea0_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.1f1815eaa1841cc1fb9f1410e1052ea0_JC.exe
Size

238KB
MD5

1f1815eaa1841cc1fb9f1410e1052ea0
SHA1

9653b58fd286a54b7f84381891090e381d3581e2
SHA256

eaff3af37e08a91ae45c13b50eb83be847b83536764db2ceeb3d43ec2467294c
SHA512

9294660db0c454a3107e507c5899affef1172d09e886d37ebd539287920a4f0459e1839b324399b56c8959ddc78e035ca9f88f981875da2b62b5f9f29ca29c97
SSDEEP

3072:dxfSmxm3eHsSxm0iYD3RNxqxnqPF3B6uKFknXphs6BHXoDNI9aI9RtEA:rfxm3eMSxDTBmxni1EuKFknXH0SaQR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.1f1815eaa1841cc1fb9f1410e1052ea0_JC.exe

Files

NEAS.1f1815eaa1841cc1fb9f1410e1052ea0_JC.exe
.dll windows:4 windows x64

0d2a0fb491967df35975e151112ec963

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
GetLastError
InitializeCriticalSection
LeaveCriticalSection
Sleep
TlsGetValue
VirtualProtect
VirtualQuery

msvcrt

__iob_func
__setusermatherr
_amsg_exit
_errno
_initterm
_lock
_unlock
abort
acos
atan
calloc
exit
free
fwrite
malloc
memcpy
memmove
memset
qsort
realloc
strcpy
strlen
strncmp
vfprintf

libogg-0

oggpack_adv
oggpack_bytes
oggpack_get_buffer
oggpack_look
oggpack_read
oggpack_readinit
oggpack_reset
oggpack_write
oggpack_writeclear
oggpack_writeinit
oggpack_writetrunc

Exports

Exports

_book_maptype1_quantvals
_book_unquantize
_float32_pack
_float32_unpack
_floor_P
_make_words
_mapping_P
_residue_P
_ve_envelope_clear
_ve_envelope_init
_ve_envelope_mark
_ve_envelope_search
_ve_envelope_shift
_vi_gpsy_free
_vi_psy_free
_vorbis_apply_window
_vorbis_block_alloc
_vorbis_block_ripcord
_vorbis_window_get
_vp_ampmax_decay
_vp_couple_quantize_normalize
_vp_global_free
_vp_global_look
_vp_noisemask
_vp_offset_and_mix
_vp_psy_clear
_vp_psy_init
_vp_tonemask
drft_backward
drft_clear
drft_forward
drft_init
floor0_exportbundle
floor1_encode
floor1_exportbundle
floor1_fit
floor1_interpolate_fit
mapping0_exportbundle
mdct_backward
mdct_clear
mdct_forward
mdct_init
ov_ilog
res0_free_info
res0_free_look
res0_inverse
res0_look
res0_pack
res0_unpack
res1_class
res1_forward
res1_inverse
res2_class
res2_forward
res2_inverse
residue0_exportbundle
residue1_exportbundle
residue2_exportbundle
vorbis_analysis
vorbis_analysis_blockout
vorbis_analysis_buffer
vorbis_analysis_headerout
vorbis_analysis_init
vorbis_analysis_wrote
vorbis_bitrate_addblock
vorbis_bitrate_clear
vorbis_bitrate_flushpacket
vorbis_bitrate_init
vorbis_bitrate_managed
vorbis_block_clear
vorbis_block_init
vorbis_book_clear
vorbis_book_codelen
vorbis_book_codeword
vorbis_book_decode
vorbis_book_decodev_add
vorbis_book_decodev_set
vorbis_book_decodevs_add
vorbis_book_decodevv_add
vorbis_book_encode
vorbis_book_init_decode
vorbis_book_init_encode
vorbis_comment_add
vorbis_comment_add_tag
vorbis_comment_clear
vorbis_comment_init
vorbis_comment_query
vorbis_comment_query_count
vorbis_commentheader_out
vorbis_dsp_clear
vorbis_granule_time
vorbis_info_blocksize
vorbis_info_clear
vorbis_info_init
vorbis_lpc_from_data
vorbis_lpc_predict
vorbis_lpc_to_lsp
vorbis_lsp_to_curve
vorbis_packet_blocksize
vorbis_staticbook_destroy
vorbis_staticbook_pack
vorbis_staticbook_unpack
vorbis_synthesis
vorbis_synthesis_blockin
vorbis_synthesis_halfrate
vorbis_synthesis_halfrate_p
vorbis_synthesis_headerin
vorbis_synthesis_idheader
vorbis_synthesis_init
vorbis_synthesis_lapout
vorbis_synthesis_pcmout
vorbis_synthesis_read
vorbis_synthesis_restart
vorbis_synthesis_trackonly
vorbis_version_string
vorbis_window

Sections

.text
Size: 161KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 288B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0d2a0fb491967df35975e151112ec963

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

libogg-0

Exports

Exports

Sections

.text Size: 161KB - Virtual size: 160KB

.data Size: 512B - Virtual size: 144B

.rdata Size: 62KB - Virtual size: 61KB

.pdata Size: 2KB - Virtual size: 2KB

.xdata Size: 4KB - Virtual size: 3KB

.bss Size: - Virtual size: 288B

.edata Size: 3KB - Virtual size: 3KB

.idata Size: 2KB - Virtual size: 1KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 512B - Virtual size: 228B

.text
Size: 161KB - Virtual size: 160KB

.data
Size: 512B - Virtual size: 144B

.rdata
Size: 62KB - Virtual size: 61KB

.pdata
Size: 2KB - Virtual size: 2KB

.xdata
Size: 4KB - Virtual size: 3KB

.bss
Size: - Virtual size: 288B

.edata
Size: 3KB - Virtual size: 3KB

.idata
Size: 2KB - Virtual size: 1KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 512B - Virtual size: 228B