Static task
static1
Behavioral task
behavioral1
Sample
NEAS.8336af34e202d0291eefd17a5ca31c70_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.8336af34e202d0291eefd17a5ca31c70_JC.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.8336af34e202d0291eefd17a5ca31c70_JC.exe
-
Size
120KB
-
MD5
8336af34e202d0291eefd17a5ca31c70
-
SHA1
074d3a1a8c5c4a926872e2d99887bbd007755980
-
SHA256
9d845b7fc87d198bfb9e0a7e6a6dafd45c0e1844a8e17902c5156ad8def9ddd7
-
SHA512
1bd06a225aaad11a2948cddd1f9972ad64c151ed908678a006894d6b2a981abe9088099638eee9996fb243b8141e5b0ba04e11a9951c280fca51d7355d9bedf2
-
SSDEEP
1536:FuqtmTxNntX7gK+F8txCoo25pF+LedxnSuAMyBisXD09VXo:YqtKbnNgKi325p8LeTSOyzDV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.8336af34e202d0291eefd17a5ca31c70_JC.exe
Files
-
NEAS.8336af34e202d0291eefd17a5ca31c70_JC.exe.exe windows:5 windows x86
91aef4d8b22e4615ed12c048246c1255
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
nss3
PR_Assert
PR_dtoa
PR_Free
PR_Now
PR_Seek64
PR_NewThreadPrivateIndex
PR_SetThreadPrivate
PR_SetCurrentThreadName
PR_snprintf
PR_NewLock
PR_DestroyLock
PR_Lock
PR_Unlock
PR_AssertCurrentThreadOwnsLock
PR_CallOnce
PR_IntervalNow
PR_WaitCondVar
PR_EnterMonitor
PR_ExitMonitor
PR_GetEnv
PR_Wait
PR_AssertCurrentThreadInMonitor
PR_GetCurrentThread
PR_smprintf_free
PR_GetThreadPrivate
PR_FileDesc2NativeHandle
PR_sscanf
PR_smprintf
xul
NS_Realloc
NS_Alloc
NS_GetMemoryManager
NS_Free
NS_CStringContainerFinish
NS_CStringContainerInit2
NS_StringContainerFinish
NS_StringContainerInit2
NS_StringContainerInit
NS_LogCOMPtrRelease
NS_LogCOMPtrAddRef
NS_LogDtor
NS_LogCtor
NS_DebugBreak
NS_NewLocalFile
NS_ShutdownXPCOM
NS_InitXPCOM2
NS_LogAddRef
NS_LogRelease
NS_StringSetDataRange
NS_CStringContainerInit
NS_CStringSetData
NS_CStringSetDataRange
NS_CStringCopy
NS_GetServiceManager
NS_GetComponentManager
NS_CStringGetData
NS_CStringCloneData
?_external_GetObserverService@services@mozilla@@YG?AU?$already_AddRefed@VnsIObserverService@@@@XZ
??0GCCellPtr@JS@@QAE@PAXW4JSGCTraceKind@@@Z
??0GCCellPtr@JS@@QAE@PAVJSObject@@@Z
??0GCCellPtr@JS@@QAE@PAVJSFunction@@@Z
??0GCCellPtr@JS@@QAE@PAVJSString@@@Z
??0GCCellPtr@JS@@QAE@PAVJSScript@@@Z
??0GCCellPtr@JS@@QAE@ABVValue@1@@Z
?isObject@GCCellPtr@JS@@QBE_NXZ
?isScript@GCCellPtr@JS@@QBE_NXZ
?toObject@GCCellPtr@JS@@QBEPAVJSObject@@XZ
?toScript@GCCellPtr@JS@@QBEPAVJSScript@@XZ
?outOfLineKind@GCCellPtr@JS@@ABE?AW4JSGCTraceKind@@XZ
NS_StringGetData
NS_StringGetMutableData
NS_StringCopy
NS_CStringGetMutableData
NS_UTF16ToCString
NS_CStringToUTF16
kernel32
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
DecodePointer
EncodePointer
GetCurrentProcess
VerSetConditionMask
GetCurrentThread
SetThreadPriority
VerifyVersionInfoA
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
ReadFile
SetEndOfFile
SetFilePointerEx
IsDebuggerPresent
TerminateProcess
OutputDebugStringA
CloseHandle
msvcr120
wcschr
strpbrk
strncpy
strchr
wcspbrk
rand
strtol
wcstol
fclose
memcpy
memcmp
_CIpow
_CIexp
fread
fseek
ftell
_wfopen
memset
srand
_fdopen
fputs
vfprintf
_vscprintf
_dup
_snprintf
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
_exit
_cexit
_configthreadlocale
__setusermatherr
_purecall
_initterm_e
_initterm
exit
memmove
__initenv
_fmode
_commode
__iob_func
fflush
fprintf
printf
putchar
vprintf
_vsnprintf
_hypot
_except_handler4_common
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
?terminate@@YAXXZ
__crtSetUnhandledExceptionFilter
_invoke_watson
_controlfp_s
wcsncmp
mozglue
moz_xrealloc
moz_xmalloc
moz_free
?moz_Xout_of_range@std@@YAXPBD@Z
?moz_Xlength_error@std@@YAXPBD@Z
malloc
free
wcsdup
strdup
realloc
msvcp120
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?_Xbad_alloc@std@@YAXXZ
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_BADOFF@std@@3_JB
_FInf
_FNan
??_7ios_base@std@@6B@
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
Sections
.text Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ