NEAS[.]bff827b8ea999403347534d72a2b29e0_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.bff827b8ea999403347534d72a2b29e0_JC.exe
Size

1.2MB
MD5

bff827b8ea999403347534d72a2b29e0
SHA1

beb8f898e52a265916bca6c5a03523c65adcc369
SHA256

59fe14004c046a426b3505705c053df6c55e03db42b5a5dfe5de8c46bd1242ab
SHA512

ca26ed526346d4acd6bb4fc43028c1ee640380d5a1df820ae3c363ceeaee07e76d4c824856321ce7666cebed082e46eaf36bf009390b2f7be35b14f0107141d3
SSDEEP

24576:sGne32ZEIOLMCldIgbEVqIi2lObXobHAEW9INFJY0au:yGZizdIgbEw7x03jY0a

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.bff827b8ea999403347534d72a2b29e0_JC.exe

Files

NEAS.bff827b8ea999403347534d72a2b29e0_JC.exe
.exe windows:6 windows x64

fc5175d5fb7babac96aa09ff83a51a07

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegDeleteKeyW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
CreateServiceW
ChangeServiceConfig2W
ControlService
DeleteService
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
SetServiceStatus
RegQueryValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
AddAccessAllowedAce
AddAce
GetAce
GetAclInformation
InitializeAcl
GetLengthSid
IsValidSid
LookupAccountNameW
CreateWellKnownSid
RegGetValueW
GetNamedSecurityInfoW
SetEntriesInAclW
SetNamedSecurityInfoW
RegEnumValueW
RegEnumKeyW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
SetSecurityDescriptorGroup
GetTokenInformation
CopySid
LookupAccountSidW
SetSecurityDescriptorOwner
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
GetSecurityDescriptorDacl
OpenProcessToken

kernel32

LoadLibraryW
GetModuleHandleW
lstrcmpiW
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleFileNameW
GetProcAddress
InitializeCriticalSection
SetEvent
Sleep
GetProfileIntW
SetPriorityClass
GetCurrentProcess
CreateEventW
ResetEvent
HeapSetInformation
GetCommandLineW
GetTempPathW
OutputDebugStringA
MoveFileExW
EnterCriticalSection
LeaveCriticalSection
GetTickCount
GetTickCount64
GetCurrentThreadId
QueueUserAPC
GetCurrentThread
SleepEx
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
DuplicateHandle
CreateThread
CreateWaitableTimerW
CancelWaitableTimer
CreateDirectoryW
SetWaitableTimer
WaitForSingleObject
GetExitCodeThread
K32GetModuleBaseNameW
GetCurrentProcessId
HeapReAlloc
OutputDebugStringW
WaitForMultipleObjects
ExitThread
GetFileAttributesW
SetFileAttributesW
OpenThread
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
WaitForMultipleObjectsEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SetThreadExecutionState
GetLocalTime
lstrlenA
GetLastError
lstrlenW
FreeLibrary
RaiseException
DeleteCriticalSection
GetProcessHeap
HeapFree
HeapAlloc
CloseHandle
GetVersionExA
GetStartupInfoW
SetUnhandledExceptionFilter
QueryPerformanceCounter
TerminateProcess
UnhandledExceptionFilter
EncodeSystemPointer
DecodeSystemPointer

user32

TranslateMessage
PostThreadMessageW
SetTimer
KillTimer
UnregisterDeviceNotification
DispatchMessageW
PeekMessageW
MsgWaitForMultipleObjectsEx
RegisterDeviceNotificationW
CharNextW
LoadStringW
UnregisterClassA

msvcrt

_resetstkoflw
_purecall
_onexit
_wfopen
_wcsnicmp
_ui64tow
wcscat_s
memcpy_s
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
calloc
_initterm
_wcmdln
exit
_cexit
_exit
_XcptFilter
__wgetmainargs
__CxxFrameHandler3
_callnewh
_CxxThrowException
??0exception@@QEAA@AEBQEBDH@Z
__C_specific_handler
memset
_localtime64
wcsftime
_time64
wcscspn
_wcsicmp
realloc
_errno
??1type_info@@UEAA@XZ
memcpy
fputws
_amsg_exit
fflush
wcstok_s
??0exception@@QEAA@XZ
memmove_s
free
malloc
wcsncpy_s
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBV0@@Z
wcsstr
_itow_s
wcsncmp
swprintf_s
_vsnwprintf
wcschr
fclose
iswalpha
wcscpy_s
floor

ole32

CoTaskMemFree
CoRevertToSelf
CoImpersonateClient
CoFreeUnusedLibrariesEx
CLSIDFromString
CoWaitForMultipleHandles
StringFromCLSID
CoCreateGuid
CoDisconnectObject
CoInitialize
CoRevokeClassObject
CoRegisterClassObject
CoUninitialize
CoInitializeEx
CoSuspendClassObjects
StringFromGUID2
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoInitializeSecurity

oleaut32

SysAllocStringByteLen
VarUI4FromStr
SysStringLen
SysAllocString
VariantInit
VariantClear
SysAllocStringLen
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayCreate
DispCallFunc
SafeArrayRedim
VarBstrCat
SysFreeString
SysStringByteLen
VarBstrCmp
SafeArrayDestroy

shlwapi

PathFileExistsW

version

GetFileVersionInfoW
VerQueryValueA
GetFileVersionInfoSizeW

ehtrace

ehTraceEvent
ehRegisterTraceGUIDs
ehFreeEventBuffer
ehUnregisterTraceGUIDs
ehAllocateEventBuffer

shell32

SHGetKnownFolderPath
SHCreateDirectoryExW

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

slc

SLGetWindowsInformationDWORD

Exports

Exports

CETWProvider_Initialize
CETWProvider_TraceCriticalCall
CETWProvider_TraceEHomeEvent
CETWProvider_TraceErrorEvent
CETWProvider_TraceErrorLevel
CETWProvider_TraceEventID
CETWProvider_TraceInfo
CETWProvider_TracePerfMarkerEnd
CETWProvider_TracePerfMarkerStart
CETWProvider_TraceTextLevel
CETWProvider_TraceVideoSize
CETWProvider_Uninitialize

Sections

.text
Size: 326KB - Virtual size: 325KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 323KB - Virtual size: 322KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fc5175d5fb7babac96aa09ff83a51a07

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

ole32

oleaut32

shlwapi

version

ehtrace

shell32

ntdll

slc

Exports

Exports

Sections

.text Size: 326KB - Virtual size: 325KB

.rdata Size: 323KB - Virtual size: 322KB

.data Size: 4KB - Virtual size: 5KB

.pdata Size: 19KB - Virtual size: 18KB

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 326KB - Virtual size: 325KB

.rdata
Size: 323KB - Virtual size: 322KB

.data
Size: 4KB - Virtual size: 5KB

.pdata
Size: 19KB - Virtual size: 18KB

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 568KB - Virtual size: 572KB