NEAS[.]02d9b3a822fcd8d0da1938ec20bfea60_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.02d9b3a822fcd8d0da1938ec20bfea60_JC.exe
Size

63KB
MD5

02d9b3a822fcd8d0da1938ec20bfea60
SHA1

d1b1bf720fad9dc1b674cde0e387f6009735ae20
SHA256

123efdd242fd08b0691e20781b6254b4ebb42cb53fcac92f0b6c4900142f7318
SHA512

55897ec47e8c9950c1e58a62df41e8dc3a62e620233750e4ec33e4f589c35eae978bb8310eb7daa25cc73179cb043398c8ad7604aec3635fe1b1beed32c2b50d
SSDEEP

1536:t209D+eOtk2wd9ClhXHFoP3w5EFQBMcAvn:tfieClhXl5EFkMcAvn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.02d9b3a822fcd8d0da1938ec20bfea60_JC.exe

Files

NEAS.02d9b3a822fcd8d0da1938ec20bfea60_JC.exe
.exe windows:4 windows x86

c5bd39b25c1de8bf10485dd5eeb952c5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapWalk
GetModuleHandleW
ClearCommBreak
CreateFiberEx
WaitForMultipleObjects
GetCPInfoExA
WTSGetActiveConsoleSessionId
DebugActiveProcessStop
FindNextVolumeMountPointA
BuildCommDCBA
FindResourceExW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 49KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE