NEAS[.]48905bf96c0dbdda9c19e1fb1fd9d080_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.48905bf96c0dbdda9c19e1fb1fd9d080_JC.exe
Size

218KB
MD5

48905bf96c0dbdda9c19e1fb1fd9d080
SHA1

5b5349bb0aa5b9db8cf5c07ca54a440f2724de7a
SHA256

1ba2ac1226ac6a1b51d7bbe422c4e72ff5e28db7a91e9ef3e90a027ac3e25ed5
SHA512

03e7fba4256f4e4ccd7dc971105150e5e258497dc9d422282fa8e1167d68d70fda1cce64c8fc66e0d349654597ac671af68d7088173c3f3d74a4edd59b8b16be
SSDEEP

6144:CuBE7EKk/Re9POivp3WmBMj29nQoNz5iNMUCG:C37P2e9Phv4mBMjqCD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.48905bf96c0dbdda9c19e1fb1fd9d080_JC.exe

Files

NEAS.48905bf96c0dbdda9c19e1fb1fd9d080_JC.exe
.exe windows:5 windows x86

1f5d8be2b39f38265c23d37fec7c7faa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

MapWindowPoints

gdi32

SetViewportExtEx

advapi32

AdjustTokenPrivileges

shell32

ShellExecuteW

ws2_32

recv

oleacc

LresultFromObject

winspool.drv

DocumentPropertiesW

oleaut32

VariantClear

Sections

.text
Size: 188KB - Virtual size: 708KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE