NEAS[.]2b5dc8c11b8bd1f823d364e839366e20_JC[.]exe | Triage

Sharing

General

Target

NEAS.2b5dc8c11b8bd1f823d364e839366e20_JC.exe
Size

294KB
MD5

2b5dc8c11b8bd1f823d364e839366e20
SHA1

86d157638abbeaa3842ca2c8c879671cb2515dd9
SHA256

8d425789999e56b9475a36e928450d8257b1804282ba2994535db67b2597d886
SHA512

3f7921c30f6754d90c33fb10c80bad30a4166bcb3c9b78843945231af544bf359fd1ac0800a8c2d85d43a8c580b1bfdf26eadff3b8efb276e1a64cc279b56e43
SSDEEP

6144:MfRuSxFMY2uYmVAvivBHDpr88CtFO4y3vVkzjIfO5L+AXbm:MgSxFMiYmVAviv5Z8nt1UkAn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.2b5dc8c11b8bd1f823d364e839366e20_JC.exe

Files

NEAS.2b5dc8c11b8bd1f823d364e839366e20_JC.exe
.exe windows:1 windows x86

91b9d16df63fda33e0171a72162c99e4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CryptBinaryToStringW

kernel32

GetLastError
GetProcAddress
LoadLibraryA
RtlUnwind
VirtualProtect
GetModuleHandleW

user32

GetWindow

shlwapi

PathAppendA
PathAppendW

crtdll

__GetMainArgs
exit
raise
signal

ulib

?Strcat@WSTRING@@QAEEPBV1@@Z
??0DSTRING@@QAE@XZ
??0STRING_ARGUMENT@@QAE@XZ
??0ARRAY@@QAE@XZ
??0ARGUMENT_LEXEMIZER@@QAE@XZ
??0FLAG_ARGUMENT@@QAE@XZ
?Initialize@ARRAY@@QAEEKK@Z
?Initialize@ARGUMENT_LEXEMIZER@@QAEEPAVARRAY@@@Z
?SetCaseSensitive@ARGUMENT_LEXEMIZER@@QAEXE@Z
?PrepareToParse@ARGUMENT_LEXEMIZER@@QAEEPAVWSTRING@@@Z

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 175KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 292B - Virtual size: 292B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE