NEAS[.]87fc42dc0d336aaab4475870081cedf0_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.87fc42dc0d336aaab4475870081cedf0_JC.exe
Size

441KB
MD5

87fc42dc0d336aaab4475870081cedf0
SHA1

388b706e34f264b69cfbea05e83d74e1562ef8a8
SHA256

5b757f24d5db0a6b1763e90e898a4826f5b6186c87501b76fdb60031aab50cb9
SHA512

2141787e35c499dc07b8d333f3f27fece993aaf0ab87fdff3d0e73f611d6dc9660976bfa045c1704b69caae017074592ddf2e4d8719777bfb6ee789f49c0d44a
SSDEEP

12288:PRMJysYCl64dH0JlJnERCoa8+yx5Yk7SPTANgLMo:PRzkF2o5x6RrAyx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.87fc42dc0d336aaab4475870081cedf0_JC.exe

Files

NEAS.87fc42dc0d336aaab4475870081cedf0_JC.exe
.exe windows:5 windows x86

99d5d54226d07fdab82543b1f9742b22

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetProcAddress
VirtualAlloc
VirtualFree
VirtualProtect

user32

GetDC

advapi32

RegCloseKey

shell32

ShellExecuteW

ws2_32

gethostbyname

iphlpapi

GetAdaptersAddresses

oleacc

LresultFromObject

gdi32

SaveDC

winspool.drv

OpenPrinterW

oleaut32

VariantClear

Sections

GGFDSDTY
Size: - Virtual size: 584KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

GGFDSDTY
Size: 436KB - Virtual size: 440KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE