NEAS[.]d9f35ec5a9dfbbe072541b4edcc317e0_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.d9f35ec5a9dfbbe072541b4edcc317e0_JC.exe
Size

73KB
MD5

d9f35ec5a9dfbbe072541b4edcc317e0
SHA1

f93a1ee8449678031065efacd8ffe9f289808c94
SHA256

e12ea0163e8b3f87ad9c479bfcd3af4f16b9e5e1d101146ff61616d01dc0c9b9
SHA512

b02d0f5755f185bb549356d44f6c0df9c793e66e0d21ebfb86b9ff8ee9e44c4b556f067010eb691c35def9e6ca7594eb9f38346a7dec34c8866ee2d51b24477b
SSDEEP

768:316+jPr2yiJ1NbkO1sY+kHgncFmYeI2Xhzo6hDsrDf+K219g6MFkkfEdV2lPEDAb:3bcXdsYRgcsw2xz94DRGKkTZ7EkU9Iz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.d9f35ec5a9dfbbe072541b4edcc317e0_JC.exe

Files

NEAS.d9f35ec5a9dfbbe072541b4edcc317e0_JC.exe
.exe windows:5 windows x86

0d726e0080cf5fcec241b132115394f6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFilePointer
WriteFile
CreateFileW
CreateMutexW
WideCharToMultiByte
MultiByteToWideChar
GetModuleHandleW
GetProcAddress
GetCommandLineW
GetModuleFileNameW
SetCurrentDirectoryW
FlushFileBuffers
IsProcessorFeaturePresent
GetStringTypeW
LCMapStringW
WriteConsoleW
CloseHandle
SetLastError
GetLastError
WaitForSingleObject
ReleaseMutex
GetCurrentProcess
SetStdHandle
IsValidCodePage
GetOEMCP
GetACP
EncodePointer
DecodePointer
HeapFree
HeapAlloc
GetCommandLineA
HeapSetInformation
RaiseException
Sleep
HeapSize
ExitProcess
HeapCreate
GetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
LoadLibraryW
RtlUnwind
GetConsoleCP
GetConsoleMode
GetCPInfo

user32

MessageBoxW

advapi32

RegCloseKey
RegCreateKeyExW
RegSetValueExW

ptrobot

PTRobot_EnumRobots
PTRobot_Initialize
PTRobot_EnumDrives
PTRobot_Destroy

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0d726e0080cf5fcec241b132115394f6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ptrobot

Sections

.text Size: 45KB - Virtual size: 44KB

.rdata Size: 15KB - Virtual size: 14KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 45KB - Virtual size: 44KB

.rdata
Size: 15KB - Virtual size: 14KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 5KB