NEAS[.]1d3035bc3d7a9ab8d0cbf6b3612fa900_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.1d3035bc3d7a9ab8d0cbf6b3612fa900_JC.exe
Size

1.5MB
MD5

1d3035bc3d7a9ab8d0cbf6b3612fa900
SHA1

2a0f8070f8f0a56631a56066ee6d9a4ae2b91f46
SHA256

d32347166109e65ffbc9532048189a18c70a984ad338a8317b49a42b5e00c9cd
SHA512

53934e62117f5abe20476d8411a786a57d921265e99f9042fc68108033f2965df44000fdff9ad3a4f4e7500faa607477955d849b4ef59474953dffabfcae348f
SSDEEP

24576:V8rbhBeCkqm39mC1GDcLj3AaCJGbPck+J+bEM3sqjnhMgeiCl7G0nehbGZpbD:Vcb7eCkq2mC1GoyGbPck+J+bESDmg27z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.1d3035bc3d7a9ab8d0cbf6b3612fa900_JC.exe

Files

NEAS.1d3035bc3d7a9ab8d0cbf6b3612fa900_JC.exe
.exe windows:10 windows x64

7ac4f35c14a5cf960487134f7c82212e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

EventRegister
EventUnregister
TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
EventWriteTransfer
OpenSCManagerW
OpenServiceW
CloseServiceHandle
RegCloseKey
CreateServiceW
RegOpenKeyExW
ChangeServiceConfig2W
QueryServiceStatusEx
ControlService
DeleteService
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
SetServiceStatus
CopySid
GetLengthSid
IsValidSid
InitializeAcl
AddAce
GetAclInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSecurityDescriptorToStringSecurityDescriptorW
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetSecurityDescriptorControl
MakeAbsoluteSD
InitializeSecurityDescriptor
GetNamedSecurityInfoW
RegQueryValueExW
RegDeleteValueW
RegSetValueExW
RegNotifyChangeKeyValue
ConvertStringSidToSidW
RegCreateKeyExW
RegSetKeySecurity
RegEnumKeyExW
RegGetValueW
EventWriteEx
SetSecurityInfo
GetSecurityInfo
SetSecurityDescriptorControl
GetAce
EqualSid
StartServiceW
ChangeServiceConfigW
LookupAccountSidW

kernel32

GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
CompareStringOrdinal
SetProcessWorkingSetSize
ResetEvent
IsWow64Process
CompareStringW
GetModuleFileNameW
DeleteTimerQueueTimer
DeleteTimerQueueEx
CreateTimerQueue
ChangeTimerQueueTimer
CreateTimerQueueTimer
FindResourceW
CompareStringA
GetFullPathNameW
MultiByteToWideChar
MulDiv
RegisterWaitForSingleObject
UnregisterWaitEx
FormatMessageW
GetProcessHeap
HeapFree
CreateThread
WaitForMultipleObjects
GetStringTypeExW
PowerClearRequest
GetComputerNameW
GetDynamicTimeZoneInformation
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFileAttributesExW
TzSpecificLocalTimeToSystemTime
GetCurrentThreadId
FindCloseChangeNotification
FindFirstChangeNotificationW
FindNextChangeNotification
WideCharToMultiByte
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
PowerSetRequest
GetTickCount64
WaitForSingleObject
CreateEventW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
HeapDestroy
HeapAlloc
HeapReAlloc
HeapSize
GetModuleHandleW
RegGetKeySecurity
RegQueryInfoKeyW
RegDeleteKeyExW
LocalFree
GetTickCount
Sleep
PowerCreateRequest
SetLastError
GetLastError
SetEvent
lstrcmpiW
FindResourceExW
LoadResource
LockResource
SizeofResource
HeapSetInformation
DeleteCriticalSection
InitializeCriticalSection
CloseHandle
RaiseException
OpenEventW
lstrcmpW
ResolveDelayLoadedAPI
DelayLoadFailureHook
GetStartupInfoW

api-ms-win-crt-string-l1-1-0

wcscmp
strncmp
wcsncmp
memset

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_register_thread_local_exe_atexit_callback
_c_exit
_initterm

api-ms-win-crt-private-l1-1-0

_o__crt_atexit
_o__errno
_o__exit
_o__get_wide_winmain_command_line
_o__i64tow_s
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__ltow_s
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__strlwr_s
_o__ui64tow_s
_o__ultoa_s
_o__ultow_s
_o__wcsicmp
_o__wcslwr_s
_o__wcsnicmp
_o__wcstoui64
_o__wputenv
_o__wtoi
_o__wtol
_o_calloc
_o_ceil
_o_exit
_o_floor
_o_free
_o_iswdigit
_o_malloc
_o_pow
_o_qsort_s
_o_terminate
_o_towupper
_o_wcscpy_s
_o_wcstol
_o_wcstoul
_o_wmemcpy_s
__current_exception
__current_exception_context
__CxxFrameHandler3
_CxxThrowException
wcsrchr
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__callnewh
strchr
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
wcsstr
__C_specific_handler
__std_terminate
__CxxFrameHandler4
__C_specific_handler_noexcept
memcmp
memcpy
memmove

user32

UnregisterPowerSettingNotification
RegisterPowerSettingNotification
PeekMessageW
DispatchMessageW
MsgWaitForMultipleObjectsEx
CharUpperW
CharUpperBuffW
wvsprintfW
UnregisterClassA

oleaut32

LoadTypeLi
LoadRegTypeLi
SysAllocStringLen
UnRegisterTypeLi
RegisterTypeLi
SysAllocString
SysFreeString
SysStringLen
VariantClear
SafeArrayDestroy
SafeArrayCreate
SafeArrayCopy
CreateErrorInfo
SetErrorInfo
SafeArrayLock
SafeArrayPtrOfIndex
SafeArrayUnlock
VariantTimeToSystemTime
SystemTimeToVariantTime
VariantInit

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance
CoInitializeSecurity
CreateStreamOnHGlobal
CoMarshalInterface
CoReleaseMarshalData
CoUnmarshalInterface
CoTaskMemFree
CoTaskMemAlloc
CLSIDFromProgID
CoCreateGuid
StringFromGUID2
CoSetProxyBlanket
IIDFromString
PropVariantClear

wsock32

WSAGetLastError

iphlpapi

NotifyAddrChange
CancelIPChangeNotify
GetIpNetEntry2
SendARP
ResolveIpNetEntry2
GetBestInterfaceEx
GetAdaptersAddresses
NotifyIpInterfaceChange
CancelMibChangeNotify2
GetIpAddrTable

shlwapi

StrChrW
PathCreateFromUrlW
PathFindExtensionW
PathFindFileNameW
ord168
ord219
PathRemoveExtensionW

ntdll

RtlVirtualUnwind
NtDeleteKey
RtlCaptureContext
RtlLookupFunctionEntry
NtQueryKey

userenv

RegisterGPNotification
UnregisterGPNotification

netapi32

NetApiBufferFree
NetShareGetInfo

propsys

PSGetPropertyKeyFromName
InitPropVariantFromCLSID
PSGetPropertyDescriptionByName
PropVariantToString
PropVariantToStringAlloc

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Sections

.text
Size: 672KB - Virtual size: 671KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 120KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 572KB - Virtual size: 576KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7ac4f35c14a5cf960487134f7c82212e

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

user32

oleaut32

ole32

wsock32

iphlpapi

shlwapi

ntdll

userenv

netapi32

propsys

api-ms-win-core-apiquery-l1-1-0

Sections

.text Size: 672KB - Virtual size: 671KB

.rdata Size: 120KB - Virtual size: 116KB

.data Size: 16KB - Virtual size: 22KB

.pdata Size: 28KB - Virtual size: 25KB

.didat Size: 4KB - Virtual size: 264B

.rsrc Size: 72KB - Virtual size: 70KB

.reloc Size: 572KB - Virtual size: 576KB

.text
Size: 672KB - Virtual size: 671KB

.rdata
Size: 120KB - Virtual size: 116KB

.data
Size: 16KB - Virtual size: 22KB

.pdata
Size: 28KB - Virtual size: 25KB

.didat
Size: 4KB - Virtual size: 264B

.rsrc
Size: 72KB - Virtual size: 70KB

.reloc
Size: 572KB - Virtual size: 576KB