NEAS[.]75dafb2da15d402ecfb7de19eff1d860_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.75dafb2da15d402ecfb7de19eff1d860_JC.exe
Size

1.3MB
MD5

75dafb2da15d402ecfb7de19eff1d860
SHA1

e2c92d5ae2a43e02d96ef9b2af53508ee40d4039
SHA256

41213a23fa4f696126897b94c8ec408a6b6033736e22b9232355a178a24ba81f
SHA512

d8ec7df365f930099b5c5291b01fc7a5e373807edcaffc8415ac9e6bf0d5021a59ae961db56388a74b02f940632c88ef231cd19bc93faa07aec395b4623b851d
SSDEEP

24576:V35HFyFeBwQy/2gHn9btXssqjnhMgeiCl7G0nehbGZpbD:V35kFeBwQy/VndtXYDmg27RnWGj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.75dafb2da15d402ecfb7de19eff1d860_JC.exe

Files

NEAS.75dafb2da15d402ecfb7de19eff1d860_JC.exe
.exe windows:6 windows x64

9a25d30dff72ef5592543b15829f0591

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

GetThreadDesktop
ChangeDisplaySettingsExA
EnumDisplaySettingsA
CloseDesktop
SetThreadDesktop
OpenInputDesktop
SendInput
GetAsyncKeyState
RegisterHotKey
SystemParametersInfoA
SetSysColors
GetSysColor
RedrawWindow
PostThreadMessageA
UnregisterDeviceNotification
RegisterDeviceNotificationA
LoadIconA
LoadStringA
RegisterRawInputDevices
GetRawInputData
GetMonitorInfoW
MonitorFromWindow
FindWindowExA
GetWindowLongPtrA
GetClientRect
GetWindowTextA
UnhookWinEvent
SetWinEventHook
GetWindowThreadProcessId
IsWindowVisible
MessageBoxW
MessageBoxA
DisplayConfigGetDeviceInfo
QueryDisplayConfig
GetDisplayConfigBufferSizes
EnumDisplayDevicesA
EnumWindows
GetPropA
wsprintfW
RegisterWindowMessageA
ChangeWindowMessageFilter
GetClassNameA
FindWindowA
GetForegroundWindow
UpdateWindow
KillTimer
SetTimer
ShowWindow
DestroyWindow
CreateWindowExA
RegisterClassA
PostQuitMessage
DefWindowProcA
PostMessageA
UnregisterPowerSettingNotification
RegisterPowerSettingNotification
SendMessageA
UnregisterHotKey
DispatchMessageA
GetMessageA

gdi32

D3DKMTPollDisplayChildren
D3DKMTQueryAdapterInfo
DeleteDC
CreateDCA
SetDeviceGammaRamp

advapi32

SetSecurityDescriptorDacl
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegGetValueW
RegGetValueA
RegSetValueExW
RegDeleteValueA
RegOpenCurrentUser
ImpersonateLoggedOnUser
InitializeSecurityDescriptor
RegEnumKeyExA
RegDeleteKeyA
ConvertStringSecurityDescriptorToSecurityDescriptorA
CreateProcessAsUserA
OpenProcessToken
RegDeleteTreeA
RevertToSelf

userenv

LoadUserProfileA
UnloadUserProfile

wtsapi32

WTSRegisterSessionNotification
WTSQueryUserToken
WTSEnumerateProcessesA
WTSFreeMemory
WTSQuerySessionInformationA

powrprof

PowerReadSettingAttributes
PowerSetActiveScheme
PowerWriteFriendlyName
PowerWritePossibleValue
PowerWritePossibleFriendlyName
PowerWriteACDefaultIndex
PowerWriteDCDefaultIndex
PowerWriteSettingAttributes
PowerRemovePowerSetting
PowerCreateSetting
PowerCreatePossibleSetting
PowerEnumerate
PowerWriteACValueIndex
PowerWriteDCValueIndex
PowerSettingAccessCheck
PowerReadACValueIndex
PowerReadDCValueIndex
PowerGetActiveScheme

setupapi

CM_Reenumerate_DevNode
CM_Get_Parent
CM_Get_DevNode_Status
CM_Get_Device_IDA
SetupDiSetClassInstallParamsA
SetupDiClassGuidsFromNameA
SetupDiGetClassDevsExA
CM_Get_DevNode_Status_Ex
CM_Get_Device_ID_ExA
SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA
SetupDiOpenDeviceInfoA
SetupDiCallClassInstaller
SetupDiGetDeviceInstanceIdA
SetupGetInfDriverStoreLocationA
SetupUninstallOEMInfA
SetupDiBuildDriverInfoList
SetupDiEnumDriverInfoA
SetupDiGetDriverInfoDetailA
SetupDiDestroyDriverInfoList
SetupDiSetDeviceRegistryPropertyA
SetupDiGetDeviceInstallParamsA
SetupDiSetDeviceInstallParamsA
CM_Get_Device_ID_Size
CM_Locate_DevNodeA
SetupDiDestroyDeviceInfoList
SetupDiGetHwProfileList
CM_Get_Child_Ex

dwmapi

ord102
DwmIsCompositionEnabled

ole32

CoUninitialize
PropVariantClear
CoInitialize
CoCreateGuid
CoCreateInstance
CoInitializeEx
CoTaskMemFree

difxapi

DriverPackageUninstallA
DriverPackageInstallA
DriverPackagePreinstallA
DriverPackageGetPathA

propsys

InitPropVariantFromDoubleVector

shlwapi

PathStripPathW
StrStrIA

newdev

DiInstallDevice

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
InterlockedPushEntrySList
InterlockedFlushSList
GetStartupInfoW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FlushFileBuffers
GetConsoleCP
GetConsoleMode
OutputDebugStringW
GetCurrentThreadId
WinExec
TerminateThread
SetEndOfFile
IsProcessorFeaturePresent
GetModuleHandleW
RtlUnwindEx
RtlPcToFileHeader
EncodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
GetCurrentProcess
ExitProcess
GetModuleHandleExW
GetCurrentThread
HeapFree
HeapAlloc
GetFileType
WideCharToMultiByte
MultiByteToWideChar
GetDateFormatW
GetTimeFormatW
CompareStringW
HeapReAlloc
HeapSize
ReadConsoleW
ReadFile
CreateFileW
SetFilePointerEx
GetFileSizeEx
SetConsoleCtrlHandler
GetProcessHeap
OpenMutexA
CreateMutexA
ReleaseMutex
WaitForMultipleObjects
OpenEventA
CreateEventA
ResetEvent
SetEvent
GetTickCount
VerifyVersionInfoW
RemoveDirectoryA
VerSetConditionMask
GetLocalTime
GetWindowsDirectoryA
FindNextFileA
FindFirstFileA
FindClose
DeleteFileA
CompareFileTime
FileTimeToSystemTime
lstrcmpA
LocalAlloc
FileTimeToLocalFileTime
SetThreadPriority
CreateThread
QueryPerformanceCounter
K32GetModuleBaseNameA
K32EnumProcessModules
QueryFullProcessImageNameA
GetEnvironmentVariableA
K32GetProcessImageFileNameA
K32EnumProcesses
GetSystemDefaultLangID
FindResourceExA
LockResource
LoadResource
FreeResource
GetSystemDirectoryA
SetLastError
GetFileTime
CreateFileA
CreateDirectoryA
ExpandEnvironmentStringsA
GetProcAddress
CopyFileA
LoadLibraryA
FreeLibrary
SetFileAttributesA
GetFileAttributesA
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
WriteConsoleW
GetSystemPowerStatus
Process32Next
Process32First
CreateToolhelp32Snapshot
QueryFullProcessImageNameW
FindFirstFileExW
lstrlenW
GetCommandLineA
GetLastError
Sleep
CreateProcessA
GetModuleFileNameA
MoveFileExA
CloseHandle
MapViewOfFile
UnmapViewOfFile
AssignProcessToJobObject
CreateFileMappingA
OpenFileMappingA
WaitForSingleObject
GetExitCodeProcess
OpenProcess
IsWow64Process
OutputDebugStringA
SetInformationJobObject
CreateJobObjectA
WTSGetActiveConsoleSessionId
LocalFree
TerminateProcess
EnumSystemLocalesW

shell32

Shell_NotifyIconA
SHGetKnownFolderPath

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

crypt32

CryptQueryObject
CertCloseStore
CryptMsgGetParam
CryptMsgClose
CryptDecodeObject

Sections

.text
Size: 541KB - Virtual size: 540KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 183KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9a25d30dff72ef5592543b15829f0591

Headers

DLL Characteristics

File Characteristics

Imports

user32

gdi32

advapi32

userenv

wtsapi32

powrprof

setupapi

dwmapi

ole32

difxapi

propsys

shlwapi

newdev

kernel32

shell32

version

crypt32

Sections

.text Size: 541KB - Virtual size: 540KB

.rdata Size: 183KB - Virtual size: 183KB

.data Size: 4KB - Virtual size: 35KB

.pdata Size: 31KB - Virtual size: 30KB

.rsrc Size: 13KB - Virtual size: 12KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 541KB - Virtual size: 540KB

.rdata
Size: 183KB - Virtual size: 183KB

.data
Size: 4KB - Virtual size: 35KB

.pdata
Size: 31KB - Virtual size: 30KB

.rsrc
Size: 13KB - Virtual size: 12KB

.reloc
Size: 568KB - Virtual size: 572KB