NEAS[.]64f13c9d9070428239ef588394ba43e0_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.64f13c9d9070428239ef588394ba43e0_JC.exe
Size

32KB
MD5

64f13c9d9070428239ef588394ba43e0
SHA1

23fcd386f3b68bc4fc39158afccb0671eb408aa9
SHA256

5efffed0294c3f769dd1aea8b82f469f52e62ff744c58e0aef0c29bea742f1da
SHA512

41adc323dce98b0805db4be88ce9ff9943a2886cd4334a73003ac9c2c0d3aaf2edcad3ea4ea87a6f9fc6e5688ef03e0a1bd214e856f8a190cc4a7d8181deb630
SSDEEP

48:IlwkMywec6NZWevhttsE0eevRlEcT/T76W9Vn1t:I2GGevVevM361t

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.64f13c9d9070428239ef588394ba43e0_JC.exe

Files

NEAS.64f13c9d9070428239ef588394ba43e0_JC.exe
.dll windows:4 windows x86

24b3d2952588080766f7fd68e6e8f755

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

DisableThreadLibraryCalls
RaiseException

Exports

Exports

PerfAddCounters
PerfCloseQueryHandle
PerfDeleteCounters
PerfEnumerateCounterSet
PerfEnumerateCounterSetInstances
PerfOpenQueryHandle
PerfQueryCounterData
PerfQueryCounterInfo
PerfQueryCounterSetRegistrationInfo

Sections

.text
Size: 4KB - Virtual size: 464B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 4KB - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 4KB - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 4KB - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ