NEAS[.]dfd4485d323f76c0de13db6e9d5e13e0_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.dfd4485d323f76c0de13db6e9d5e13e0_JC.exe
Size

119KB
MD5

dfd4485d323f76c0de13db6e9d5e13e0
SHA1

21c6197c32eb33a4514515cd585ee028840a6f7c
SHA256

25988ae8eedb84bf8f62c6241960728b71200a5101674672c267f59e8ae7b610
SHA512

492aaaf1ce2462da309cc6542a2cb28b9cc8bb96fe8a33ebbc71e30b091e27360d14800087e20dde933f4e587210aa72f528fe078aa5fa2069a0af607b94c9a1
SSDEEP

1536:A415xMybJGRvmaRq1SRNHZgTGnqvZyAVUC3eJC/cHiH5Uc6A5oh1msgTsINILp6d:A4/ya89fRq1UN+dtVn5ZUcQh1csVar

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.dfd4485d323f76c0de13db6e9d5e13e0_JC.exe

Files

NEAS.dfd4485d323f76c0de13db6e9d5e13e0_JC.exe
.exe windows:4 windows x86

e8b91ee1236802169a14af835c8848e4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetErrorMode
WriteFileEx
SortGetHandle
Wow64RevertWow64FsRedirection
AddIntegrityLabelToBoundaryDescriptor
GetMailslotInfo
GetLocaleInfoW
CloseThreadpoolCleanupGroup
VerLanguageNameW
lstrcatW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE