NEAS[.]def4dbd40936143f30cab0f16c021920_JC[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.def4dbd40936143f30cab0f16c021920_JC.exe
Size

362KB
MD5

def4dbd40936143f30cab0f16c021920
SHA1

8ab50ab52b5a565acbc39ecff036ccc96a1edc30
SHA256

c89ddc008096dc1aef844a188e9ef05095028829f574ae3b84c45ba3f5163768
SHA512

5fad23e52f1945127e4e98533ad7de18f92ec93c168d790e38eb8b640fe9f511396ffd0d89fe767f1de3770829ece55666512ac5eda07b7849d00e1b9e45e2af
SSDEEP

6144:rO70f/Ind4r+m687JyAoMyEjgTBqosbU2bqt:iEwk687h1yEjgTsrTbqt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.def4dbd40936143f30cab0f16c021920_JC.exe

Files

NEAS.def4dbd40936143f30cab0f16c021920_JC.exe
.dll windows:4 windows x86

2797712421eb05aa0e2d487b6c83c192

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msi

ord74
ord17
ord125
ord8
ord103

kernel32

LoadLibraryW
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetCurrentProcess
FindClose
FindFirstFileW
GetVolumeInformationW
GetFullPathNameW
FileTimeToLocalFileTime
GetFileAttributesW
GetFileTime
lstrcmpW
GlobalFlags
CompareStringW
GetVersionExA
LoadLibraryA
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
GetModuleHandleA
InterlockedExchange
CompareStringA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
HeapReAlloc
SetStdHandle
GetFileType
HeapSize
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
Sleep
SetHandleCount
GetStdHandle
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
GetTickCount
GetSystemTimeAsFileTime
VirtualAlloc
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
SetErrorMode
GetCurrentThreadId
FileTimeToSystemTime
GetThreadLocale
GetVersion
InterlockedIncrement
FreeLibrary
InterlockedDecrement
GetModuleHandleW
GetProcAddress
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GetCurrentProcessId
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageW
LocalFree
lstrlenW
SetLastError
SetFilePointer
WriteFile
ReadFile
CreateFileA
CreateFileW
GetLastError
GetFileSize
CloseHandle
GetSystemTime
WideCharToMultiByte
MultiByteToWideChar
GetModuleFileNameW
QueryPerformanceCounter
FindResourceW
LoadResource
LockResource
SizeofResource

advapi32

RegQueryValueExW
IsTextUnicode
RegOpenKeyExW
RegDeleteValueW
RegEnumValueW
RegDeleteKeyW
RegCreateKeyExW
RegSetValueExW
RegCloseKey

shell32

SHGetFolderPathW

shlwapi

PathFindFileNameW
PathStripToRootW
PathIsUNCW
PathFindExtensionW

oleacc

CreateStdAccessibleObject
LresultFromObject

user32

DrawTextW
DrawTextExW
GrayStringW
DestroyMenu
PostQuitMessage
UnregisterClassA
GetPropW
RemovePropW
GetForegroundWindow
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
GetClientRect
GetMenu
PostMessageW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
CopyRect
DefWindowProcW
CallWindowProcW
SystemParametersInfoA
IsIconic
GetWindowPlacement
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
TabbedTextOutW
SetWindowPos
SetWindowLongW
IsWindow
GetDlgItem
GetFocus
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassNameW
PtInRect
SetWindowTextW
UnregisterClassW
SetWindowsHookExW
CallNextHookEx
DispatchMessageW
GetKeyState
PeekMessageW
ValidateRect
GetWindowTextW
LoadCursorW
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
GetCapture
GetClassLongW
UnhookWindowsHookEx
GetWindowThreadProcessId
SendMessageW
GetParent
GetWindowLongW
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxW
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
RegisterWindowMessageW
LoadIconW
CheckMenuItem
WinHelpW
EnableMenuItem
SetPropW
CharUpperW

gdi32

SetWindowExtEx
ScaleWindowExtEx
DeleteDC
GetStockObject
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
GetClipBox
SetTextColor
CreateBitmap
SaveDC
RestoreDC
RectVisible
PtVisible
DeleteObject
SetBkColor
GetDeviceCaps
SetMapMode
TextOutW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

comdlg32

GetFileTitleW

oleaut32

VariantChangeType
VariantClear
VariantInit

Exports

Exports

Install
PreInstall
Uninstall

Sections

.text
Size: 180KB - Virtual size: 177KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1012B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2797712421eb05aa0e2d487b6c83c192

Headers

File Characteristics

Imports

msi

kernel32

advapi32

shell32

shlwapi

oleacc

user32

gdi32

winspool.drv

comdlg32

oleaut32

Exports

Exports

Sections

.text Size: 180KB - Virtual size: 177KB

.rdata Size: 48KB - Virtual size: 45KB

.data Size: 12KB - Virtual size: 22KB

.rsrc Size: 4KB - Virtual size: 1012B

.reloc Size: 20KB - Virtual size: 19KB

.text
Size: 180KB - Virtual size: 177KB

.rdata
Size: 48KB - Virtual size: 45KB

.data
Size: 12KB - Virtual size: 22KB

.rsrc
Size: 4KB - Virtual size: 1012B

.reloc
Size: 20KB - Virtual size: 19KB