NEAS[.]7de29f6c549a7d8d9b4c26337e55adc0_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.7de29f6c549a7d8d9b4c26337e55adc0_JC.exe
Size

143KB
MD5

7de29f6c549a7d8d9b4c26337e55adc0
SHA1

ce115e44157e9fc1c8546bbfef104e133848e858
SHA256

f41d964bf71b43c93bd9f79300d50a90428033853eb2f9ab2855371316ce626d
SHA512

0cf97c8463ed883a9a452871c9c16ae12ed131ee37fe3c920d2175417ba5c0a067891b62c16a18e05bcefd9d8434b65976e0fc0bc9e206da5836f89dca24e58f
SSDEEP

3072:GWMIJWZY1gTz6Anp7+s7q5s81+1zJFpriSrY18:wogqAnZJ25VOpe0Ye

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.7de29f6c549a7d8d9b4c26337e55adc0_JC.exe

Files

NEAS.7de29f6c549a7d8d9b4c26337e55adc0_JC.exe
.exe windows:1 windows x86

d82ceab8013612dc27ff5d9983c81aac

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CryptBinaryToStringA

kernel32

GetLastError
GetProcAddress
LoadLibraryA
RtlUnwind
VirtualProtect
SetLastError
GetModuleHandleA
lstrcpyA
lstrcmpA
lstrcatA
lstrcmpiA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime

shlwapi

PathAppendA

crtdll

__GetMainArgs
exit
raise
signal

framedyn

?ReleaseBuffer@CHString@@QAEXH@Z

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 40B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc2
Size: 200B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE