NEAS[.]2f47ab8830ba79bcec6885ec5f6cbeb0_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.2f47ab8830ba79bcec6885ec5f6cbeb0_JC.exe
Size

146KB
MD5

2f47ab8830ba79bcec6885ec5f6cbeb0
SHA1

3c3bf866b1978973fe8a78c66351bcdc2a07f9cc
SHA256

7bae480f1e863910b910d23e53293159567e90d9b234344fedde2dc9aa1886e6
SHA512

6af9537d6bd8ef8a32d7fc8043559003a1db2e8e06b2e3976e03e6760d7beb509487057a86706d7f5c881f54f3e1e9b431604bb1d8814cc4c8dccefaae2e3d46
SSDEEP

3072:yA4GU4QVmTbVPE7YaXYCfNicisMANRzikt3Ufw21cuFQaArhGOU1nmi5Gub:yF4pVPaoqPoFQaAUn+ub

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.2f47ab8830ba79bcec6885ec5f6cbeb0_JC.exe

Files

NEAS.2f47ab8830ba79bcec6885ec5f6cbeb0_JC.exe
.exe windows:1 windows x86

4d82a1a8ac7dae247b7e65f9bf1173b2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CryptBinaryToStringA

kernel32

GetLastError
GetProcAddress
LoadLibraryA
RtlUnwind
VirtualProtect
GetModuleHandleA
FormatMessageA
LocalFree
GetTickCount
LocalAlloc
InterlockedCompareExchange

user32

GetCursorPos
CharToOemBuffA

crtdll

__GetMainArgs
exit
raise
signal

mswsock

s_perror

ws2_32

WSASocketW
WSAEventSelect

advapi32

RegOpenKeyExA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 40B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 126KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc2
Size: 427B - Virtual size: 427B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE