Static task
static1
Behavioral task
behavioral1
Sample
NEAS.06dea111de1fd5a385530238358fbd70_JC.exe
Resource
win7-20231023-en
General
-
Target
NEAS.06dea111de1fd5a385530238358fbd70_JC.exe
-
Size
350KB
-
MD5
06dea111de1fd5a385530238358fbd70
-
SHA1
9a57defa637a4ee721f6ac999bbf43f0305b775a
-
SHA256
31f12c42f26c51f198605ab8c932c03acb56ba28d91509847ba0641d2bd5c01f
-
SHA512
27ebe8573acaacf02d22af7f94f114a0f935dd41cc4ba2792c24eca4d07a8b8d21301a1bd23b839676e2fc11cb1e6c909e1fa1c1d2a5e8a1ce0516b69569082a
-
SSDEEP
6144:8IWWnu8O3UiPelvcRioCbwp+a5wtGAyPPQLSV0C70b:8/WuzhRiFc4FGAyPsSny
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.06dea111de1fd5a385530238358fbd70_JC.exe
Files
-
NEAS.06dea111de1fd5a385530238358fbd70_JC.exe.exe windows:4 windows x86
a49b7a31cae68370c7fdca256ea47ae1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetLastError
WritePrivateProfileStringW
OutputDebugStringA
GetModuleFileNameW
GetPrivateProfileStringW
lstrlenA
GetFileAttributesW
WideCharToMultiByte
GetPrivateProfileStringA
MultiByteToWideChar
GetPrivateProfileIntW
GetCurrentProcessId
LoadLibraryW
EnterCriticalSection
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
LoadLibraryExW
lstrcmpiW
GetSystemDirectoryW
DeleteCriticalSection
CreateProcessW
DeleteFileW
GetCommandLineW
FreeLibrary
GetTempPathW
CreateDirectoryW
InitializeCriticalSection
CopyFileW
FindNextFileW
FindClose
FindFirstFileW
WriteFile
FileTimeToSystemTime
ReadFile
GetLocalTime
GetFileInformationByHandle
SetFilePointer
SystemTimeToFileTime
GetVersionExW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GlobalMemoryStatusEx
GetThreadLocale
IsProcessorFeaturePresent
InterlockedCompareExchange
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
RaiseException
InterlockedExchange
LoadLibraryA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
RtlUnwind
GetConsoleMode
GetConsoleCP
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
ExitProcess
GetModuleFileNameA
GetStdHandle
HeapSize
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
TlsFree
OpenProcess
GetModuleHandleW
GetProcAddress
GetExitCodeThread
FlushInstructionCache
Sleep
GetCurrentProcess
TerminateThread
GetTickCount
CreateFileMappingW
LeaveCriticalSection
lstrcpyW
FindResourceExW
LoadResource
LockResource
SizeofResource
CreateThread
WaitForSingleObject
FindResourceW
lstrlenW
GetLastError
CreateFileW
UnmapViewOfFile
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
GetStartupInfoW
GetProcessHeap
GetVersionExA
HeapReAlloc
HeapFree
HeapAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetFileSize
MapViewOfFile
CloseHandle
SetStdHandle
user32
ScreenToClient
SendMessageW
DefWindowProcW
GetSystemMenu
GetDlgItem
SetWindowLongW
EnableWindow
SetDlgItemTextW
GetWindowLongW
MoveWindow
GetMenuItemCount
GetMenuItemID
ShowWindow
GetWindowRect
EnableMenuItem
SetForegroundWindow
DispatchMessageW
TranslateMessage
PeekMessageW
GetMessageW
PostMessageW
GetWindowTextLengthW
wvsprintfW
DialogBoxParamW
UpdateWindow
DrawIcon
InvalidateRect
CallWindowProcW
EndDialog
GetDesktopWindow
CharNextW
wvsprintfA
MessageBoxW
PostQuitMessage
IsWindowVisible
wsprintfA
LoadBitmapW
wsprintfW
ReleaseDC
LoadCursorW
LoadStringW
SetCursor
GetWindowDC
RedrawWindow
EndPaint
GetActiveWindow
GetCursorPos
GetDlgCtrlID
GetWindowTextW
SetWindowTextW
BeginPaint
DestroyWindow
CreateDialogParamW
UnregisterClassA
gdi32
CreateSolidBrush
TextOutW
SetBkMode
SetTextColor
CreateFontW
DeleteObject
BitBlt
CreateCompatibleDC
CreateBitmap
DeleteDC
SetBkColor
SelectObject
advapi32
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
shell32
SHGetFolderPathW
SHGetFileInfoW
ShellExecuteW
ShellExecuteA
CommandLineToArgvW
ole32
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
oleaut32
VarUI4FromStr
shlwapi
PathRemoveFileSpecW
PathStripPathW
PathFindFileNameW
PathAppendW
comctl32
ImageList_DrawEx
ImageList_Destroy
ImageList_LoadImageW
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
ws2_32
htons
inet_addr
gethostbyname
connect
WSAAsyncSelect
setsockopt
socket
WSACleanup
closesocket
WSAStartup
WSAGetLastError
send
psapi
EnumProcesses
GetModuleFileNameExW
GetProcessMemoryInfo
wininet
InternetCloseHandle
InternetReadFile
HttpSendRequestW
HttpOpenRequestW
InternetConnectW
InternetSetOptionW
InternetOpenW
Sections
.text Size: 200KB - Virtual size: 198KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE