NEAS[.]b8a29557f164586d8719586fb765ffd0_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.b8a29557f164586d8719586fb765ffd0_JC.exe
Size

119KB
MD5

b8a29557f164586d8719586fb765ffd0
SHA1

aa45cc969bc662acf8336aa3906e3ad1766c6ac7
SHA256

4a1c1b50632e903007eb5fc411e852ee05718e1ee47c1bd2459bb79a3578ceac
SHA512

4df549c4d9d973ec918e10fce341201a58c945dda72ce9bf11ac87e5e7220c667ebb73c91f0c2df15d9b756238123665de8bfd9be87968b11df1f65d6672da63
SSDEEP

3072:5gznELCgZMfk8ulA53thmt+UXLpN9S7h/tipnO7L:azQbycxlEe+IHy/UpnO/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.b8a29557f164586d8719586fb765ffd0_JC.exe

Files

NEAS.b8a29557f164586d8719586fb765ffd0_JC.exe
.exe windows:4 windows x86

15847df048a61281178a41a21ed20ba9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FoldStringA
UnmapViewOfFileEx
SetProcessShutdownParameters
NlsEventDataDescCreate
GetCurrentConsoleFont
Module32FirstW
ReplaceFile
WriteTapemark
CmdBatNotification
QueryIoRateControlInformationJobObject

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE