NEAS[.]24f36a6c07365cdee375d3528463de00_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.24f36a6c07365cdee375d3528463de00_JC.exe
Size

119KB
MD5

24f36a6c07365cdee375d3528463de00
SHA1

5be723b78c1ae95568ed03bea94fce375f84c43e
SHA256

73b186b6c91ca32e8ce99efe80a3afd49b01b8de3d277965ed4e3dd4f2e37052
SHA512

2d1fc62dde4ab998cb2a3d07103518ee8743a5d7daa657ea0fcffb0cbc99ec030f3e46276a8af009d9baeb8971c6b30378f2c1508da07a43751a72c26b00dc56
SSDEEP

3072:9rjray39ZhaNN+9ePnsz3258ANbXDL3vXIaaH40EU:Ba/NQ9Qnsz26G3/XI1H4hU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.24f36a6c07365cdee375d3528463de00_JC.exe

Files

NEAS.24f36a6c07365cdee375d3528463de00_JC.exe
.exe windows:4 windows x86

2a65292b788777c4264e6b05ddc0a2c8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetDriveTypeW
LCMapStringEx
BaseDumpAppcompatCacheWorker
NtVdm64CreateProcessInternalW
GetThreadDescription
SetMailslotInfo
DosDateTimeToFileTime
GetVolumeNameForVolumeMountPointA
NlsEventDataDescCreate

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE