NEAS[.]9ff1887b7c6c4449bf5136491c46ee01_JC[.]exe | Triage

Sharing

General

Target

NEAS.9ff1887b7c6c4449bf5136491c46ee01_JC.exe
Size

124KB
MD5

9ff1887b7c6c4449bf5136491c46ee01
SHA1

c151aa4b54f52969874477cae95e700b91182c15
SHA256

b9d9e438f3c230b493c4e04523859bcecdfc829e9e894814315ca46ee18d58aa
SHA512

0a21158d7bc950cb9332edadb03f4c182161ffb5c2e55fedb3520cea27020da42ce6a2147fa0dc96abf1f70f0a9e85e1efe6bc12841d90eb1518556aa2b5415e
SSDEEP

3072:2q8f/oic1i9uTAlPQSDwEyWefHEvGdxETCpPJ:18f/U1iF/sUGdxET

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.9ff1887b7c6c4449bf5136491c46ee01_JC.exe

Files

NEAS.9ff1887b7c6c4449bf5136491c46ee01_JC.exe
.exe windows:5 windows x86

ac92baf84ed1ae1c5f0fb7d23652858d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

user32

SetTimer

shell32

ShellExecuteExW

ole32

CoInitializeEx

psapi

GetModuleBaseNameW

shlwapi

StrStrNIW

ntdll

memset

advapi32

RegFlushKey

msvcrt

__DestructExceptionObject

Sections

.didata
Size: 119KB - Virtual size: 172KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE