NEAS[.]5281b8d0f9d1d85cdbfec8b18d0445a0_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.5281b8d0f9d1d85cdbfec8b18d0445a0_JC.exe
Size

50KB
MD5

5281b8d0f9d1d85cdbfec8b18d0445a0
SHA1

011c8c6a23e5afa186d494bc5bfd9c1764f2d588
SHA256

3b751c9d647fd317afb8d9a33bacb5385cc026ecdae81250e7456839db36faf5
SHA512

a908ab736559bc09fa6169f2072c4876a19df1b700043285db73e388f7cba07f0c2e820ac20f08382a1123a69b3c51e4690d11cc97a3c6c828a12f9cd54d7c05
SSDEEP

768:ZRAOMlCxS5koLb/Anvc1HhdBndil5kr5RX28mPHL3RQTPQWGQg/xS05:LMlCxS5V/rphdil5koQzQWE5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.5281b8d0f9d1d85cdbfec8b18d0445a0_JC.exe

Files

NEAS.5281b8d0f9d1d85cdbfec8b18d0445a0_JC.exe
.dll windows:4 windows x64

73e3c7cacfbd4005b9029ca5f5dc7b2d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
GetLastError
InitializeCriticalSection
LeaveCriticalSection
Sleep
TlsGetValue
VirtualProtect
VirtualQuery

msvcrt

__iob_func
__setusermatherr
_amsg_exit
_errno
_initterm
_lock
_unlock
abort
calloc
free
fwrite
log10
memmove
memset
realloc
strlen
strncmp
tanh
vfprintf

libglib-2.0-0

g_free
g_intern_static_string
g_log
g_malloc
g_mutex_lock
g_mutex_unlock
g_once_init_enter
g_once_init_leave
g_return_if_fail_warning

libgobject-2.0-0

g_object_class_find_property
g_object_class_install_property
g_object_notify
g_object_set
g_param_spec_boolean
g_param_spec_double
g_param_spec_int
g_type_class_adjust_private_offset
g_type_class_peek_parent
g_type_name
g_type_register_static_simple
g_value_get_boolean
g_value_get_double
g_value_get_int
g_value_set_boolean
g_value_set_double
g_value_set_int

libgstaudio-1.0-0

gst_audio_info_from_caps

libgstbase-1.0-0

gst_base_transform_get_type
gst_base_transform_set_gap_aware
gst_base_transform_set_passthrough

libgstpbutils-1.0-0

gst_missing_element_message_new

libgstreamer-1.0-0

_gst_debug_category_new
_gst_debug_min
_gst_debug_register_funcptr
_gst_element_error_printf
gst_bin_get_type
gst_buffer_get_size
gst_buffer_map
gst_buffer_unmap
gst_core_error_quark
gst_debug_log
gst_element_add_pad
gst_element_class_add_static_pad_template
gst_element_class_set_static_metadata
gst_element_factory_make
gst_element_get_static_pad
gst_element_message_full
gst_element_post_message
gst_element_register
gst_event_new_tag
gst_event_parse_tag
gst_ghost_pad_new_from_template
gst_message_new_element
gst_mini_object_copy
gst_mini_object_unref
gst_object_unref
gst_pad_event_default
gst_pad_push_event
gst_pad_set_event_function_full
gst_plugin_register_static
gst_structure_new
gst_tag_list_add
gst_tag_list_get_double
gst_tag_list_is_empty
gst_tag_list_new_empty
gst_tag_list_remove_tag
gst_util_uint64_scale_int_ceil

libintl-8

DllMain

Exports

Exports

gst_element_register_rganalysis
gst_element_register_rglimiter
gst_element_register_rgvolume
gst_plugin_replaygain_get_desc
gst_plugin_replaygain_register
gst_rg_analysis_get_type
gst_rg_limiter_get_type
gst_rg_volume_get_type
rg_analysis_album_result
rg_analysis_analyze
rg_analysis_analyze_mono_float
rg_analysis_analyze_mono_int16
rg_analysis_analyze_stereo_float
rg_analysis_analyze_stereo_int16
rg_analysis_destroy
rg_analysis_init_silence_detection
rg_analysis_new
rg_analysis_reset
rg_analysis_reset_album
rg_analysis_set_sample_rate
rg_analysis_start_buffer
rg_analysis_track_result

Sections

.text
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 384B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

73e3c7cacfbd4005b9029ca5f5dc7b2d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

libglib-2.0-0

libgobject-2.0-0

libgstaudio-1.0-0

libgstbase-1.0-0

libgstpbutils-1.0-0

libgstreamer-1.0-0

libintl-8

Exports

Exports

Sections

.text Size: 29KB - Virtual size: 29KB

.data Size: 512B - Virtual size: 512B

.rdata Size: 9KB - Virtual size: 8KB

.pdata Size: 1KB - Virtual size: 1KB

.xdata Size: 1KB - Virtual size: 1KB

.bss Size: - Virtual size: 384B

.edata Size: 1024B - Virtual size: 872B

.idata Size: 4KB - Virtual size: 4KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 512B - Virtual size: 148B

.text
Size: 29KB - Virtual size: 29KB

.data
Size: 512B - Virtual size: 512B

.rdata
Size: 9KB - Virtual size: 8KB

.pdata
Size: 1KB - Virtual size: 1KB

.xdata
Size: 1KB - Virtual size: 1KB

.bss
Size: - Virtual size: 384B

.edata
Size: 1024B - Virtual size: 872B

.idata
Size: 4KB - Virtual size: 4KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 512B - Virtual size: 148B