NEAS[.]ebd665dd158de7a16e4ebc285979ea30_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.ebd665dd158de7a16e4ebc285979ea30_JC.exe
Size

1.2MB
MD5

ebd665dd158de7a16e4ebc285979ea30
SHA1

58c5fbd67ad96c06a71a9bce952d93bf5570f7de
SHA256

f7ca2856d97ba8afeffdbf889c1d3f057339fb881615ab8e32b90f392eaa83e8
SHA512

de4e1594fecc8f74aacf57e31a39e36b859aed441b3a5a4b9b5793cd1abda21dc58803fada648dbdfcf6a08a692b5f1dc63fb67e06c279425080997920842453
SSDEEP

6144:ZsN+QhAPai5tHr/MxHqnP3tCEr89EsbD62Z+w4VoH46hMKPX:W5hAPjPHr/wiPkEr89Eogw4VoH4cj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.ebd665dd158de7a16e4ebc285979ea30_JC.exe

Files

NEAS.ebd665dd158de7a16e4ebc285979ea30_JC.exe
.exe windows:5 windows x86

6d1f028787ecd18f946abf29ae022207

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetProcAddress
VirtualAlloc
VirtualFree
VirtualProtect

user32

EndPaint

advapi32

RegCloseKey

shell32

ShellExecuteA

iphlpapi

GetAdaptersInfo

ws2_32

htonl

wtsapi32

WTSRegisterSessionNotification

Sections

.text
Size: 65KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 443KB - Virtual size: 623KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Khsgd
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE