NEAS[.]5116c21eb096c0a72e41b19507174e80_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.5116c21eb096c0a72e41b19507174e80_JC.exe
Size

119KB
MD5

5116c21eb096c0a72e41b19507174e80
SHA1

769ee382d8395d3d64fe7d8ea9b53c54a84d21f0
SHA256

315d3d171e078ce805b2c6caba1d96a7de98e85d8ad02058d975fca539f096ec
SHA512

7be0b1d72ade60d771354a92255e023dc8651d0fc2e88b87c5090bf0e33002c2836366e0bedac561e37b85253a0e047ddc8443e9107d855cba4bf0ca4bd7d53c
SSDEEP

3072:YR7RGDf3vnlvNttru0kSHjA2PMF7Dfi3ARq0s:YuDPPzttru0kU0723J

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.5116c21eb096c0a72e41b19507174e80_JC.exe

Files

NEAS.5116c21eb096c0a72e41b19507174e80_JC.exe
.exe windows:4 windows x86

4c0994c8f81e1d7320cc1b206496aef5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VerifyScripts
Toolhelp32ReadProcessMemory
EnumSystemLocalesW
ReOpenFile
RtlCaptureContext
ClearCommBreak
GlobalUnlock
BaseDestroyVDMEnvironment
PackageFamilyNameFromId
EnumCalendarInfoA
SetThreadpoolThreadMaximum

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE