NEAS[.]b7ae751a846852a057c8e291d4882b40_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.b7ae751a846852a057c8e291d4882b40_JC.exe
Size

119KB
MD5

b7ae751a846852a057c8e291d4882b40
SHA1

62e6a17babc7bee21444d80d1f84ca645afc70c2
SHA256

6b33c61afa900b4af75ef2d6cc142c48eb0985e0c2be677894d509674f5c5822
SHA512

2ae5cacb95a1bd720197508fdcccf2c3ab5f53c441b0e3808841a2e8b78adef9ed0f2371e9c34ee543e7adc0ca384b924764a9538ac4a3c1956374e344c18109
SSDEEP

3072:wcX31K8d8nDiiqURl+W2DpB8vtUzXUyeIfkBf2GaFpLKPB5rIq:rX3ruDiRURl+JLK5H+m5sq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.b7ae751a846852a057c8e291d4882b40_JC.exe

Files

NEAS.b7ae751a846852a057c8e291d4882b40_JC.exe
.exe windows:4 windows x86

1c07acedf8636d126099e457fd02369c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateHardLinkTransactedA
FindFirstVolumeA
VDMConsoleOperation
lstrcmpA
K32GetModuleFileNameExW
CopyContext
CreateMemoryResourceNotification
WerGetFlags
RegDeleteTreeA
WerRegisterMemoryBlock

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE