NEAS[.]edea14e8f56f559d5475ab8db2a30f50_JC[.]exe | Triage

Sharing

General

Target

NEAS.edea14e8f56f559d5475ab8db2a30f50_JC.exe
Size

119KB
MD5

edea14e8f56f559d5475ab8db2a30f50
SHA1

0e5b0f2eb846819b1e0383b5f28a3aaeae9d4c3b
SHA256

5b752efde9bf1a914ca0a56a36dcfd2e833d7f2613fb12b7b5ea2a8aebdaa894
SHA512

56e236f87991d3e211c02c771e0be09500e8f09034a7ddd05f5c78985d83859f557a50e5f2e0523f8adc364587c777da67a8253995300245d6d01273ba022bc8
SSDEEP

3072:ZdRjSCF3CecnGOymLzGwaQelC3uPTMCRH6ZM:rJSCFiH1mLVHIM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.edea14e8f56f559d5475ab8db2a30f50_JC.exe

Files

NEAS.edea14e8f56f559d5475ab8db2a30f50_JC.exe
.exe windows:4 windows x86

742baadf4ef3b6e071f926471ac29044

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetUserDefaultGeoName
SetVolumeLabelA
GetStateFolder
IsBadWritePtr
WriteConsoleInputVDMW
HeapAlloc
QueryPerformanceFrequency
InterlockedExchangeAdd
ReplaceFile
GetCPInfoExA
OpenJobObjectA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE