NEAS[.]25c637c13e1a384fd9b97c8bd045f000_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.25c637c13e1a384fd9b97c8bd045f000_JC.exe
Size

119KB
MD5

25c637c13e1a384fd9b97c8bd045f000
SHA1

9b76ec7a945902b5b9368a443f7498f5dc08030b
SHA256

14cf2542f9e6aa0ce086610331d3e9a17eeccf9a45311e245e147cfa0aa981fb
SHA512

23a2e970c84caeb1e6cc6cf848431a997979356b52dd7752a4d64722ad7fd4299fd24efd8b3bffb42384e61db14b75bad6edcd7d55eb9a27e78ba335a02e5480
SSDEEP

3072:SqvvWA5EsFDR4rCkXOhRsRI94FhXGh+If5P:Sqvr5LFDOaHqkhB5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.25c637c13e1a384fd9b97c8bd045f000_JC.exe

Files

NEAS.25c637c13e1a384fd9b97c8bd045f000_JC.exe
.exe windows:4 windows x86

d98201c77b16b6bfd59590f88102bf51

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WerpGetDebugger
lstrlenW
Thread32First
ExitProcess
SetFileTime
AppPolicyGetLifecycleManagement
GetCommProperties
SetSearchPathMode
MoveFileTransactedW
RegEnumValueA
SetCachedSigningLevel

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE