Static task
static1
Behavioral task
behavioral1
Sample
NEAS.491a980fab196527c90b1a4fe5d2d490_JC.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.491a980fab196527c90b1a4fe5d2d490_JC.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.491a980fab196527c90b1a4fe5d2d490_JC.exe
-
Size
179KB
-
MD5
491a980fab196527c90b1a4fe5d2d490
-
SHA1
8ff0ed18f1d9b390be20792d78fafa7a7741b366
-
SHA256
b90b5a23bb99df714a83dcfa8397a970e88f9e36b7e37413546a8fde6401d454
-
SHA512
dc2859b78b0b00b4b43adeaa762a67cec394d7a3f7ba599e52cf7bed89ea4a569e010be0d2c8d07440dc63a12e9be27e0b8c57a2520211f7ed811105b6041ddc
-
SSDEEP
3072:NC0w0gCKw0gCKw0gCyAAd0wvCATlYYVmzozlgI7cxPthQUhU:NxcFcFcPziZkCHEJgI7cxFSsU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.491a980fab196527c90b1a4fe5d2d490_JC.exe
Files
-
NEAS.491a980fab196527c90b1a4fe5d2d490_JC.exe.exe windows:1 windows x86
a33dcbf8860328e7931d1ffd0b8787be
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
Imports
crypt32
CryptBinaryToStringW
user32
LoadAcceleratorsA
LoadCursorA
LoadIconA
RegisterClassW
ole32
CoInitialize
CoUninitialize
kernel32
CreateFileA
FindNextVolumeW
FindVolumeClose
GetLastError
GetModuleHandleA
GetProcAddress
GetVolumeNameForVolumeMountPointW
GetVolumePathNamesForVolumeNameW
LoadLibraryA
LocalAlloc
LocalFree
SetLastError
VirtualProtect
FindFirstVolumeW
ntdll
NtClose
NtOpenKey
NtOpenSymbolicLinkObject
NtQueryInformationFile
NtQuerySymbolicLinkObject
NtQueryValueKey
NtSetInformationFile
RtlAllocateHeap
RtlEqualUnicodeString
RtlFreeHeap
RtlInitUnicodeString
RtlUnicodeStringToAnsiString
NtOpenFile
advapi32
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
Sections
AUTO Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DGROUP Size: 121KB - Virtual size: 364KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 190B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size:
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc2 Size: 131B - Virtual size: 131B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE