NEAS[.]8cfb243bef57509a726dc7cc226e9a20_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.8cfb243bef57509a726dc7cc226e9a20_JC.exe
Size

119KB
MD5

8cfb243bef57509a726dc7cc226e9a20
SHA1

d85f5fa83e65ccdbf3055e588bb72dd71f2e2602
SHA256

1353fce1cab5e2f2b1b4157c9e95c3bce8c0b5703db37f62719ac5f7a766653f
SHA512

00666f6a9f7891d15258f60d0de57d8f5c41a4488ec9194b1faa99fd6393250047a4a2f589758844b32b8b19931dae9e2513bad9cdfc7582766424f23f6ea1cc
SSDEEP

3072:6gYTx4xPIHCrVnT6E7xeRh4SSeo7DALs/Qn:sUPkWV2E7xez4Reo7DIs/u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.8cfb243bef57509a726dc7cc226e9a20_JC.exe

Files

NEAS.8cfb243bef57509a726dc7cc226e9a20_JC.exe
.exe windows:4 windows x86

6655fcbd8a5583b6ec6a51d802926ff4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SleepEx
IsNativeVhdBoot
VirtualProtect
InitOnceComplete
GetFileAttributesTransactedW
WerRegisterFileWorker
CreateEventA
SetFileTime
BasepGetExeArchType
TerminateThread
OpenWaitableTimerA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE