NEAS[.]f627a31b46bc24d4e82f93b1e0801b00_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.f627a31b46bc24d4e82f93b1e0801b00_JC.exe
Size

119KB
MD5

f627a31b46bc24d4e82f93b1e0801b00
SHA1

a579952dbf2eef0888de146d58aa17f04ad47f1a
SHA256

0d0664a761f9c3f8b96e75c62ac68cede3ff07d07de91a84d595a74de33540d7
SHA512

4ea81f8c1b4dde4cde493a5a872fad3a8c08b4411ff40f595b8bd9fe0d63f801973b72b35f362d63ca19ee5c4d564a4b431531cf5d027f1e138725247da05d9c
SSDEEP

1536:YKv9q6ra/bxiERc04+flxP6XKDjY+giARCC6owjpZXp4gO0F/SM+jmBIQtyU7NZ2:HVicERcwfrPZzjCv6oQBFMUxCWG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.f627a31b46bc24d4e82f93b1e0801b00_JC.exe

Files

NEAS.f627a31b46bc24d4e82f93b1e0801b00_JC.exe
.exe windows:4 windows x86

4d6429537aeb89f9b0a6fa47609b2360

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

EndUpdateResourceW
GlobalUnWire
CreateThreadpoolWork
CreateWaitableTimerExA
CreateSymbolicLinkA
QuirkIsEnabled2Worker
GetThreadErrorMode
CreateMailslotA
CheckNameLegalDOS8Dot3W
ActivateActCtxWorker

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE