NEAS[.]135316ed7f689ef13b8a497901f60f00_JC[.]exe | Triage

Sharing

General

Target

NEAS.135316ed7f689ef13b8a497901f60f00_JC.exe
Size

95KB
MD5

135316ed7f689ef13b8a497901f60f00
SHA1

3453bc5afa5fae9058c92816d63064f8647503a4
SHA256

bdb9a67ff2c17444a498b378d9218842ed0af2a6bf62d2ddc87139c380e5b724
SHA512

05fee92a07c2ba4d2b1e98791be426d80c3a796c1c17cfedd89aeda190a9dedd9f1562d87d8b85c64a06e4f6daff662eb33ab8eba27170f4c42d1eb1d4a9294a
SSDEEP

1536:LI72UvJ6q3QyHFdD2XsyAY1bLr7FuVHn3z2xJ2fTYU0t0l5snR+7WGDFBj3P7fzn:LtUEUHFdSXeIfr7MH3zYgx0t+Ss7WGDH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.135316ed7f689ef13b8a497901f60f00_JC.exe

Files

NEAS.135316ed7f689ef13b8a497901f60f00_JC.exe
.exe windows:4 windows x86

ff8d7455c0c0e36566b9c305ac38acea

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindNextChangeNotification
BeginUpdateResourceA
OpenEventW
Process32FirstW
SetFileShortNameA
DnsHostnameToComputerNameA
FreeLibrary
Module32NextW
BeginUpdateResourceA
GetConsoleInputExeNameW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ice
Size: 39KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE