NEAS[.]68131683b96b80f0f7cdc620f2564740_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.68131683b96b80f0f7cdc620f2564740_JC.exe
Size

3.5MB
MD5

68131683b96b80f0f7cdc620f2564740
SHA1

c8e51fb5bf20c73118314b8faa22fc04ee3701a0
SHA256

1638e3889f7cf12fa9405a59291e46c8cf72678479be7f4f7da59d471d5b331f
SHA512

bdc23e2be99f40ca9a02c5cde1a37439ea9acb768c8e0fed152a8f484d42e198fc96d2959614b79cfd46dd3d7f35b24e8c2b3481da9762f9115791c0c26e1396
SSDEEP

49152:QPihq2Gb49HIBv7xbTwHleX88NDfLp27palbvI4VdzAp9GZjEnYyPguqqf+4q:Q4Szb7zAnGSY7uqqf+d

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.68131683b96b80f0f7cdc620f2564740_JC.exe

Files

NEAS.68131683b96b80f0f7cdc620f2564740_JC.exe
.exe windows:6 windows x64

96d858c96b3dded0e9eb523d441c891e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CreatePipe
DeleteCriticalSection
TerminateJobObject
GetStartupInfoW
WideCharToMultiByte
LeaveCriticalSection
WriteFile
EnterCriticalSection
GetSystemDirectoryW
GlobalMemoryStatusEx
PeekNamedPipe
AssignProcessToJobObject
CreateProcessW
GetConsoleWindow
CreateJobObjectW
ReadFile
GetFileSize
CreateFileA
FindClose
FindNextFileA
FileTimeToSystemTime
FindFirstFileA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetDriveTypeA
GetLogicalDriveStringsA
SetEndOfFile
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetFullPathNameW
GetCurrentDirectoryW
SetStdHandle
GetTimeZoneInformation
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetConsoleOutputCP
GetModuleFileNameW
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetDriveTypeW
SetConsoleCtrlHandler
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
LoadLibraryExW
FreeLibrary
GetLogicalDriveStringsW
InitializeCriticalSection
Sleep
WaitForSingleObject
SetEvent
CloseHandle
CreateThread
RtlPcToFileHeader
CreateEventW
InterlockedPushEntrySList
RtlUnwindEx
OutputDebugStringW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
GetSystemTimeAsFileTime
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
TryEnterCriticalSection
GetCurrentThreadId
FormatMessageA
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentProcessorNumber
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
GetStringTypeW
GetCPInfo
GetLastError
SetLastError
TryAcquireSRWLockExclusive
TlsGetValue
TlsSetValue
GetSystemInfo
RaiseException
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionAndSpinCount
ResetEvent
VirtualAlloc
VirtualFree
TlsAlloc
SwitchToThread
CreateFileW
CreateFileMappingW
MapViewOfFileEx
lstrlenW
UnmapViewOfFile
TlsFree
GetStdHandle
GetFileType
DeleteFiber
GetSystemTime
SystemTimeToFileTime
FindFirstFileW
FindNextFileW
GetCurrentProcessId
ConvertFiberToThread
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
InitializeSListHead
WaitForSingleObjectEx
RtlCaptureContext
RtlUnwind

user32

MsgWaitForMultipleObjects
PeekMessageW
EnumDisplaySettingsW
EnumDisplayMonitors
MessageBoxA
GetDC
GetDesktopWindow
ShowWindow
wsprintfW
GetProcessWindowStation
DispatchMessageW
GetMonitorInfoW
MessageBoxW
GetUserObjectInformationW
TranslateMessage

gdi32

BitBlt
GetObjectW
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetDIBits

advapi32

CryptDestroyKey
CryptAcquireContextA
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptGetUserKey
CryptSetHashParam
CryptGetProvParam
RegCloseKey
RegQueryValueExW
RegOpenKeyW
CryptGenRandom

ole32

CoCreateInstance
CoInitialize

oleaut32

VariantInit

ws2_32

getaddrinfo
WSAStringToAddressW
WSAIoctl
WSASetLastError
shutdown
freeaddrinfo
send
htons
getsockname
getpeername
closesocket
WSAGetLastError
gethostname
InetNtopW
bind
socket
WSAStartup
WSACleanup
ntohl
ntohs
connect
recv
WSAWaitForMultipleEvents
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
setsockopt

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore

bcrypt

BCryptGenRandom

shlwapi

StrChrW

winmm

timeBeginPeriod
timeEndPeriod
timeGetDevCaps
timeGetTime

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 63KB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

96d858c96b3dded0e9eb523d441c891e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

ws2_32

crypt32

bcrypt

shlwapi

winmm

Sections

.text Size: 2.1MB - Virtual size: 2.1MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 63KB - Virtual size: 2.1MB

.pdata Size: 106KB - Virtual size: 106KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 36KB - Virtual size: 35KB

.text
Size: 2.1MB - Virtual size: 2.1MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 63KB - Virtual size: 2.1MB

.pdata
Size: 106KB - Virtual size: 106KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 36KB - Virtual size: 35KB