NEAS[.]d018cf32e3940d9e4cb1f23a0adf0ac0_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.d018cf32e3940d9e4cb1f23a0adf0ac0_JC.exe
Size

210KB
MD5

d018cf32e3940d9e4cb1f23a0adf0ac0
SHA1

cdc052fb883452bde64b61cfa29d3b233094eadf
SHA256

5a14aba969d3b057ef9272dd58696af901c2d45ddb6f6fba0001ff1e80259c97
SHA512

72f8a51c0efb7f2e14accd7094a147ff29a2e059ef6f1e71aa2a4ff468c3c71ea5954e4cdaf9ff0f0bfeeb4f5458c71db14bb4486c2674f7c82fb3fb32371aac
SSDEEP

6144:fRh8kXpF13fIRj2N0cp7Yfh2xrtAbUR6A8U5CcyzH:L/D6d+j9YmAbURT8U5Ryz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.d018cf32e3940d9e4cb1f23a0adf0ac0_JC.exe

Files

NEAS.d018cf32e3940d9e4cb1f23a0adf0ac0_JC.exe
.exe windows:1 windows x86

efd64979adc7f9e8aae1d77756433b49

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
RtlUnwind
GetModuleHandleW

crtdll

__GetMainArgs
exit
raise
signal

ulib

??1ARGUMENT_LEXEMIZER@@UAE@XZ
??0DSTRING@@QAE@XZ
??0STRING_ARGUMENT@@QAE@XZ
??0ARRAY@@QAE@XZ
??0ARGUMENT_LEXEMIZER@@QAE@XZ
??0FLAG_ARGUMENT@@QAE@XZ
?Initialize@ARRAY@@QAEEKK@Z
?Initialize@ARGUMENT_LEXEMIZER@@QAEEPAVARRAY@@@Z
?SetCaseSensitive@ARGUMENT_LEXEMIZER@@QAEXE@Z
?PrepareToParse@ARGUMENT_LEXEMIZER@@QAEEPAVWSTRING@@@Z

ntdll

RtlFreeHeap

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 178KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ