NEAS[.]2a94bf0cf2dc13d2beb8ac411a1964f0_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.2a94bf0cf2dc13d2beb8ac411a1964f0_JC.exe
Size

29KB
MD5

2a94bf0cf2dc13d2beb8ac411a1964f0
SHA1

7721645cb186ea8a5435ad2c05b84389b387094a
SHA256

48421e6a82e157b732406a067b6f58177834057e0d5c41973787a475705a5698
SHA512

2f96885d777692205863fad9db727554695158700fdc7dcb31d8edd6406d8554ac3ce1a8feaf88848ad656d6606443d260ca9808512ddf238f400aee5607ae46
SSDEEP

384:xHiYvN0bIAuI+bYKEupiEF7TM7rmoEfzK6GrnAcD9a+nam5J6PlAqnv:kbrmC7qoEe6GrnAchagam5YO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.2a94bf0cf2dc13d2beb8ac411a1964f0_JC.exe

Files

NEAS.2a94bf0cf2dc13d2beb8ac411a1964f0_JC.exe
.dll windows:6 windows x64

e4142744b12b415e487282dd18de3743

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

gstaudio-1.0-0

gst_audio_sink_get_type
gst_audio_iec61937_frame_size
gst_audio_iec61937_payload
gst_stream_volume_get_type
gst_audio_ring_buffer_parse_caps

glib-2.0-0

g_mutex_init
g_locale_to_utf8
g_strdup
g_return_if_fail_warning
g_list_prepend
g_utf16_to_utf8
g_log
g_utf8_to_utf16
g_malloc_n
g_free
g_once_init_leave
g_once_init_enter
g_mutex_unlock
g_mutex_lock
g_mutex_clear
g_intern_static_string

gstreamer-1.0-0

gst_plugin_register_static
GST_CAT_DEFAULT
gst_device_provider_class_set_static_metadata
gst_device_provider_get_type
gst_element_register
gst_device_provider_register
gst_object_unref
gst_clock_get_time
gst_clock_new_single_shot_id
gst_element_factory_make
gst_device_get_type
gst_static_caps_get
gst_structure_free
gst_structure_new
_gst_debug_min
gst_pad_query_caps
gst_util_uint64_scale_int
gst_system_clock_obtain
_gst_debug_register_funcptr
_gst_debug_category_new
gst_debug_log
gst_resource_error_quark
gst_element_message_full
_gst_element_error_printf
gst_element_class_set_static_metadata
gst_element_class_get_pad_template
gst_element_class_add_static_pad_template
gst_pad_template_get_caps
gst_query_set_accept_caps_result
gst_query_parse_accept_caps
gst_buffer_copy_into
gst_buffer_unmap
gst_buffer_map
gst_buffer_new_allocate
gst_caps_to_string
gst_caps_subtract
gst_caps_intersect_full
gst_caps_is_subset
gst_caps_is_fixed
gst_caps_get_structure
gst_caps_new_empty_simple
gst_structure_get_boolean
gst_mini_object_replace
gst_mini_object_copy
gst_mini_object_unref
gst_mini_object_ref
gst_clock_single_shot_id_reinit
gst_clock_id_unschedule
gst_clock_id_wait
gst_clock_id_unref

gobject-2.0-0

g_value_get_string
g_value_set_string
g_object_new
g_value_get_double
g_value_set_double
g_value_dup_string
g_object_set
g_value_get_boolean
g_type_name
g_type_class_peek_parent
g_type_register_static_simple
g_type_add_interface_static
g_type_class_adjust_private_offset
g_object_class_install_property
g_param_spec_boolean
g_param_spec_double
g_param_spec_string
g_value_set_boolean

dsound

ord1
ord2

ole32

StringFromCLSID
CLSIDFromString
CoTaskMemFree

kernel32

LocalFree
FormatMessageA
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
IsDebuggerPresent
SetUnhandledExceptionFilter
RtlCaptureContext
RtlLookupFunctionEntry
UnhandledExceptionFilter
RtlVirtualUnwind

user32

GetDesktopWindow

vcruntime140

__std_type_info_destroy_list
__C_specific_handler
memcpy
memset

api-ms-win-crt-utility-l1-1-0

_swab

api-ms-win-crt-math-l1-1-0

log10

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_initterm_e
_initterm
_initialize_onexit_table
_seh_filter_dll
_initialize_narrow_environment
_cexit
_execute_onexit_table

Exports

Exports

gst_plugin_directsound_get_desc
gst_plugin_directsound_register

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e4142744b12b415e487282dd18de3743

Headers

DLL Characteristics

File Characteristics

Imports

gstaudio-1.0-0

glib-2.0-0

gstreamer-1.0-0

gobject-2.0-0

dsound

ole32

kernel32

user32

vcruntime140

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 14KB - Virtual size: 14KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 84B

.text
Size: 14KB - Virtual size: 14KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 84B