NEAS[.]58c1cadaf97e5d4a43a60f1fac66a6a0_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.58c1cadaf97e5d4a43a60f1fac66a6a0_JC.exe
Size

1.0MB
MD5

58c1cadaf97e5d4a43a60f1fac66a6a0
SHA1

35b0d02c68832ff58df84fdcaf94e4fe9aab1c6c
SHA256

2e7ee5a42e9943ca53c50b86e6e45970fb8bd928236e075ea8cfbbe87bd6ffb6
SHA512

b2c926ba0423242263de6839c47f95f88480b0f06c9a91edd55185d7ef6ed7882c6bb677ed5cfe7b323255938cb640d10a013edf2213fefa93b6a7ef4a39bbeb
SSDEEP

12288:W5hAPjPHr/wiPkEr89Eogw4VoH4cjnoteFlLD1AVs3Gb5oVjcD:WgLr4w9beH4enIeLFAVwGV4S

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.58c1cadaf97e5d4a43a60f1fac66a6a0_JC.exe

Files

NEAS.58c1cadaf97e5d4a43a60f1fac66a6a0_JC.exe
.exe windows:5 windows x86

6d1f028787ecd18f946abf29ae022207

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetProcAddress
VirtualAlloc
VirtualFree
VirtualProtect

user32

EndPaint

advapi32

RegCloseKey

shell32

ShellExecuteA

iphlpapi

GetAdaptersInfo

ws2_32

htonl

wtsapi32

WTSRegisterSessionNotification

Sections

.text
Size: 65KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 443KB - Virtual size: 623KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Khsgd
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE