NEAS[.]738aba9207c884df1176b2e241326870_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.738aba9207c884df1176b2e241326870_JC.exe
Size

50KB
MD5

738aba9207c884df1176b2e241326870
SHA1

7f8640de74dd5bc5367ad25cbb488baae6e78969
SHA256

7cffef83649b891a51cf205112926edd3bf1e299536810e98c244c31e97fa129
SHA512

3590f80f991898c51446779adf7e01ada8c6d471332016a652b444ac1e036ea66f53c751649b1c47fbc849419162d050b4a733ac4a5d181322d4e34ba33e480b
SSDEEP

768:3vKPjUJap1c1LpH8l43dvY55xnED4VbSWiMKJT:3iUWa1N8lqdvY55BED4VeWid

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.738aba9207c884df1176b2e241326870_JC.exe

Files

NEAS.738aba9207c884df1176b2e241326870_JC.exe
.exe windows:6 windows x86

f57e95b11cd7b2b8f1d327353ce150a4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

apphelp

SdbDeletePermLayerKeys
SdbEnumMsiTransforms
SdbFindFirstMsiPackage
SdbFindFirstMsiPackage_Str
SdbFindFirstNamedTag
SdbFindFirstTag
SdbFindFirstTagRef
SdbFindNextMsiPackage
SdbFindNextTag

mstask

NetrJobEnum
NetrJobGetInfo
SAGetAccountInformation
SAGetNSAccountInformation
SASetAccountInformation
SASetNSAccountInformation
SetNetScheduleAccountInformation

certcli

CAAccessCheck
CAAccessCheckEx

regapi

RegWdQueryA
RegWdQueryA
RegWdQueryA
RegWdQueryA
RegWdQueryA
RegWdQueryA
RegWdQueryA
RegWdQueryW
RegCdCreateW
RegCdDeleteA
RegCdDeleteW
RegCdEnumerateA
RegCdEnumerateW
RegCdQueryA
RegCdQueryW
RegCloseServer
RegUserConfigRename
RegOpenServerA
RegPdEnumerateA

msvcrt

fopen
fread

kernel32

GetSystemDirectoryA
OutputDebugStringW
IsDebuggerPresent
MulDiv
GetTickCount
GetACP
LoadLibraryA
FindVolumeClose
GetCommandLineA

htui

HTUI_DeviceColorAdjustment
HTUI_DeviceColorAdjustmentA
HTUI_DeviceColorAdjustmentW
HTUI_DeviceColorAdjustment
HTUI_DeviceColorAdjustmentA
HTUI_DeviceColorAdjustmentW

iashlpr

AllocateAttributes

sti

StiCreateInstance

polstore

IPSecClosePolicyStore
IPSecCopyFilterData
IPSecCopyFilterSpec
IPSecCopyISAKMPData
IPSecCopyNFAData
IPSecCopyNegPolData
IPSecCopyPolicyData
IPSecCreateFilterData
IPSecCreateISAKMPData
IPSecCreateNFAData
IPSecCreateNegPolData
IPSecCreatePolicyData
IPSecDeleteFilterData
IPSecDeleteISAKMPData
IPSecDeleteNFAData

dbghelp

ImageRvaToSection
ImageRvaToVa

Sections

.text
Size: 7KB - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

rsRC
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f57e95b11cd7b2b8f1d327353ce150a4

Headers

File Characteristics

Imports

apphelp

mstask

certcli

regapi

msvcrt

kernel32

htui

iashlpr

sti

polstore

dbghelp

Sections

.text Size: 7KB - Virtual size: 4KB

.data Size: 12KB - Virtual size: 12KB

rsRC Size: 25KB - Virtual size: 25KB

.text
Size: 7KB - Virtual size: 4KB

.data
Size: 12KB - Virtual size: 12KB

rsRC
Size: 25KB - Virtual size: 25KB