Static task
static1
Behavioral task
behavioral1
Sample
NEAS.cafb584976ece3c6159b0f14f7b35f20_JC.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.cafb584976ece3c6159b0f14f7b35f20_JC.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.cafb584976ece3c6159b0f14f7b35f20_JC.exe
-
Size
94KB
-
MD5
cafb584976ece3c6159b0f14f7b35f20
-
SHA1
b1d0f3bb862d78b4a814a42aca66b7b7bb60354f
-
SHA256
0a9d9a389d0eb6161220b5c820f016b5189b5c911c744c67da2e7c9fda4e2a4e
-
SHA512
b6472752dc6fa00c9e5fe471d25bf04ca56dd04170717a357ed1a1c3c42abfcd43419104ce27846179c3531f085e1104bb809a24269c7817c291980553f2bbb8
-
SSDEEP
1536:+z8erPJC9O8ziPaArrK6LOhKvgEVPiGmBgZgqGIL/plNgWjzRcBRMxjxT3auc:CPJN8zY9XXOcgqQyWqj7NgWj2B+pxuuc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.cafb584976ece3c6159b0f14f7b35f20_JC.exe
Files
-
NEAS.cafb584976ece3c6159b0f14f7b35f20_JC.exe.exe windows:4 windows x86
2f40576424d4d31165b0172c617edead
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
atoi
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_open
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_write
_close
_lseek
_eof
_read
_EH_prolog
__CxxFrameHandler
??2@YAPAXI@Z
??3@YAXPAX@Z
free
malloc
fopen
fwrite
fclose
memcpy
localtime
strftime
time
srand
rand
strncpy
strchr
strcmp
sprintf
memset
sscanf
strlen
strcpy
_adjust_fdiv
strcat
_stricmp
kernel32
SetFileTime
GetLastError
DuplicateHandle
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32First
Process32Next
GetModuleHandleA
HeapAlloc
ReadProcessMemory
OpenProcess
lstrcmpiA
GetCurrentProcess
GetVersion
OpenEventA
CloseHandle
GetTempPathA
GetProcessHeap
CreateFileA
WriteFile
FindResourceA
LoadResource
LockResource
SizeofResource
SetFileAttributesA
GetProcAddress
GetStartupInfoA
user32
SendMessageA
wsprintfA
FindWindowA
advapi32
RegOpenKeyExA
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 75KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ