NEAS[.]b304865a2a7da916d69b5b7810d20300_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.b304865a2a7da916d69b5b7810d20300_JC.exe
Size

119KB
MD5

b304865a2a7da916d69b5b7810d20300
SHA1

32bdb185dadec78c172f8efc6bdeb261b5131ec8
SHA256

9e3a890e602a9fe31ba68a2140b20d359fe04e794af4abda3a6a67fd61cc98d3
SHA512

60362e848f04117a69401376d011b6a2bbfddbe1000fee44baa1e96130a41c907a0d600003bd3ed98e49ba22070fb08dd458cba1704263b0c1d9bee697fe4377
SSDEEP

3072:aUjXZZXc8Ugupc8cOrsTZ4mgKTjQuJ+G1dIfEKflxQOJMSsR7:aUjXbslgUNX0GwQuMGMvfl/JQ7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.b304865a2a7da916d69b5b7810d20300_JC.exe

Files

NEAS.b304865a2a7da916d69b5b7810d20300_JC.exe
.exe windows:4 windows x86

7341fa7919d873466f885c22848e9d3b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetVolumeLabelA
IsProcessorFeaturePresent
DeleteProcThreadAttributeList
LZSeek
SetVolumeLabelA
SetThreadLocale
BuildCommDCBA
RegRestoreKeyA
GetAtomNameW
GetNamedPipeClientProcessId
BuildCommDCBW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE