NEAS[.]214cc443e9091cf27ebdab0910979e20_JC[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.214cc443e9091cf27ebdab0910979e20_JC.exe
Size

397KB
MD5

214cc443e9091cf27ebdab0910979e20
SHA1

f67b16aed7c39c2b5b7922693516517815bff0fc
SHA256

4faf93f84124021b7212882b62823e4cd3cbed44ce447f818373c57a20a75f4e
SHA512

5e76f8ace59133d47281fd1af668947749b378b0afb9827fa87b62478a962697d62f5825d0cbe9c8fbc3f225da69e9d57a9ced20dfa09109c9cd2bb6fc87c0f5
SSDEEP

12288:zoGaUi3KcAxHCfJy/viudf77SBAlnsRBa:zoGaU3CEvb72uig

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.214cc443e9091cf27ebdab0910979e20_JC.exe

Files

NEAS.214cc443e9091cf27ebdab0910979e20_JC.exe
.dll windows:6 windows x86

5b07cd4d4a4d92ca801936bbc5d1a0d7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Sleep
FreeResource
LoadResource
LockResource
SizeofResource
FindResourceA
lstrcpynA
lstrcpyA
lstrcatA
lstrlenA
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetModuleHandleA
QueryPerformanceCounter
IsDebuggerPresent
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
CloseHandle
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LoadLibraryExA
GetProcAddress
GetModuleHandleW
FreeLibrary
VirtualQuery
VirtualProtect
GetSystemInfo
RaiseException
InitializeSListHead
GetModuleFileNameA
GetSystemDirectoryA
DeleteCriticalSection
LeaveCriticalSection
GetTickCount
EnterCriticalSection
InitializeCriticalSection
GetLastError
OutputDebugStringA
GetCurrentDirectoryA
GetCurrentProcessId
SetCurrentDirectoryA

user32

wsprintfA

advapi32

RegOpenKeyExW
RegCloseKey
RegQueryValueExW

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

msvcp140

?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
_Query_perf_counter
_Query_perf_frequency

vcruntime140

__std_type_info_destroy_list
__current_exception_context
__current_exception
strstr
strrchr
strchr
_purecall
__CxxFrameHandler3
__std_exception_destroy
__std_exception_copy
memset
memmove
memcpy
memcmp
memchr
__std_terminate
_CxxThrowException
_except_handler4_common

api-ms-win-crt-runtime-l1-1-0

_set_invalid_parameter_handler
_cexit
terminate
_initterm
_invalid_parameter_noinfo_noreturn
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit

api-ms-win-crt-string-l1-1-0

_strlwr
strtok_s
isdigit
_strnicmp
isalpha
strncmp
isalnum
isxdigit
tolower
toupper
isupper
wcsncpy
_stricmp
strncat
isspace
strlen
strcmp
wcscpy_s

api-ms-win-crt-heap-l1-1-0

calloc
_callnewh
free
malloc

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
__stdio_common_vsprintf_s
__stdio_common_vsnprintf_s
__stdio_common_vsscanf

api-ms-win-crt-time-l1-1-0

_mktime64
_time64
_difftime64
_localtime64
_gmtime64

api-ms-win-crt-multibyte-l1-1-0

_mbsstr

api-ms-win-crt-convert-l1-1-0

atoi

Exports

Exports

PlugInMain

Sections

.text
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 257KB - Virtual size: 260KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5b07cd4d4a4d92ca801936bbc5d1a0d7

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

version

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-convert-l1-1-0

Exports

Exports

Sections

.text Size: 109KB - Virtual size: 109KB

.rdata Size: 22KB - Virtual size: 21KB

.data Size: 3KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 108B

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 257KB - Virtual size: 260KB

.text
Size: 109KB - Virtual size: 109KB

.rdata
Size: 22KB - Virtual size: 21KB

.data
Size: 3KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 108B

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 257KB - Virtual size: 260KB