Static task
static1
Behavioral task
behavioral1
Sample
NEAS.bcff3e45ae2df89bb88a15d73c852c40_JC.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.bcff3e45ae2df89bb88a15d73c852c40_JC.exe
Resource
win10v2004-20231025-en
General
-
Target
NEAS.bcff3e45ae2df89bb88a15d73c852c40_JC.exe
-
Size
1.2MB
-
MD5
bcff3e45ae2df89bb88a15d73c852c40
-
SHA1
355b933226ff1ef0878257f4d4d71d9c7ad514f4
-
SHA256
1e58cd828a1cf92da04636c627227abf074da5ab400bf01d271ee4adbd888442
-
SHA512
1ec73dcaed7b70c6e8c380a8487dcc18993fe49fdb772bea4f60c4c76bc80e6df6bcc16ce8acf68210dad20ae1e1b25d4d2d38392ebd742f49dce25940124253
-
SSDEEP
24576:0qjpIYHAagNx1o9qlQsx4MWf1701eGtVTV/rIYkz:0qj+YHAZ7/usRecVTJrIYk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.bcff3e45ae2df89bb88a15d73c852c40_JC.exe
Files
-
NEAS.bcff3e45ae2df89bb88a15d73c852c40_JC.exe.exe windows:6 windows x64
9f9a361806f030c8f794019ee6d4bfe1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
IsDebuggerPresent
GetCurrentProcess
CreateFileW
GetCurrentThread
GetDriveTypeW
InstallELAMCertificateInfo
CopyFileW
SetDefaultDllDirectories
MultiByteToWideChar
LoadLibraryExA
DebugBreak
GetModuleHandleW
GetProcessHeap
GetCurrentProcessId
CreateMutexExW
GetProcAddress
HeapAlloc
CloseHandle
OpenSemaphoreW
WaitForSingleObjectEx
OutputDebugStringW
GetLastError
FormatMessageW
GetVolumeNameForVolumeMountPointW
ReleaseMutex
GetCurrentThreadId
GetFileAttributesW
WaitForSingleObject
FindClose
GetModuleHandleExW
ReleaseSemaphore
FindNextFileW
SetLastError
HeapFree
CreateSemaphoreExW
FindFirstFileW
GetLogicalDrives
GetVolumeInformationW
DeleteFileW
GetModuleFileNameA
VirtualQuery
VirtualProtect
GetSystemInfo
WriteConsoleW
FindFirstFileExW
GetFileAttributesExW
GetFinalPathNameByHandleW
SetEndOfFile
SetFileInformationByHandle
SetFilePointerEx
AreFileApisANSI
GetFileInformationByHandleEx
WideCharToMultiByte
LocalFree
FormatMessageA
LCMapStringEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
CompareStringEx
GetCPInfo
GetStringTypeW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleFileNameW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
HeapReAlloc
GetFileSizeEx
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
ReadConsoleW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
HeapSize
RtlUnwind
advapi32
OpenSCManagerW
OpenThreadToken
OpenServiceW
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
LookupPrivilegeValueW
AdjustTokenPrivileges
CreateServiceW
RegCloseKey
CloseServiceHandle
TraceMessage
ChangeServiceConfig2W
RegCreateKeyExW
DeleteService
ControlService
RegSetValueExW
OpenProcessToken
StartServiceW
RegOpenKeyExW
RegGetValueW
RegCreateKeyW
fltlib
FilterConnectCommunicationPort
FilterUnload
FilterSendMessage
setupapi
SetupGetLineTextW
SetupOpenInfFileW
SetupGetTargetPathW
Sections
.text Size: 501KB - Virtual size: 500KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 136KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 572KB - Virtual size: 576KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE