NEAS[.]879dbf5006af45fa2db6b861beefe100_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.879dbf5006af45fa2db6b861beefe100_JC.exe
Size

247KB
MD5

879dbf5006af45fa2db6b861beefe100
SHA1

ee9d3d07d8af62d4efbefd0c3958d16cc85902dc
SHA256

60061a27d6f2aa328e14433dd028f2cf75ac886d295fe8e1ec9e4003cdde8eba
SHA512

2634f843919d1049d4c140b1867b85a043f9a9bf5124a1ec5de4e47a6299fc6f7ccf682f115889641fd32b1d9b8c2be961a387f5fd6ba77cdb3a304d70cd13ec
SSDEEP

3072:DzjAuUfkkPk4D3bwyPYl9p+vzjtmYZjjaaab/NDE8eUu5J98WCNYMK6RsjFys4w:/VUz39AYvzWaab4Uu5BwXRsA4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.879dbf5006af45fa2db6b861beefe100_JC.exe

Files

NEAS.879dbf5006af45fa2db6b861beefe100_JC.exe
.exe windows:4 windows x86

b94d94a0b90e423d4ce8cf62b8434956

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileA
GetACP
VirtualAlloc
GetOEMCP
GetCurrentProcess

user32

LoadCursorW
LoadCursorA

msvcrt

__getmainargs
__setusermatherr
__p__commode
_acmdln
__set_app_type
_controlfp
_except_handler3
exit
_XcptFilter
_cexit
_exit
__p__fmode
_c_exit

advapi32

RegOpenKeyA
RegQueryValueExA

Sections

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata52
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata51
Size: 238KB - Virtual size: 238KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ggg22
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ