NEAS[.]6cde12b206531b6912cc48db8c659d6d_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.6cde12b206531b6912cc48db8c659d6d_JC.exe
Size

329KB
MD5

6cde12b206531b6912cc48db8c659d6d
SHA1

eaeb3b5492839d80de753e8d3ec75b3050f5b34f
SHA256

e23123194256b1a4662d3a247b13163c5fc4a3e5e5c025a8d6bec062531454f7
SHA512

5fb0ffd40e33a741ecb12963c69bba7e2cbbd2c695495d7cf4705099043537496f864f3f51aa6f811c291d546de58d8fc7a258e0d2afb8f7277537799ba080d1
SSDEEP

6144:Wbp4JXa3vgPHQvEhZmvCrycKgBtyhXn/R3fo8CX/J0:2p4ivgPH5fmvgMX/JA6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.6cde12b206531b6912cc48db8c659d6d_JC.exe

Files

NEAS.6cde12b206531b6912cc48db8c659d6d_JC.exe
.exe windows:5 windows x86

aac73941c87ad61412ca8ad4d2283df3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

DestroyMenu

advapi32

RegQueryValueExW

shell32

ShellExecuteW

ws2_32

gethostbyaddr

iphlpapi

GetAdaptersInfo

oleacc

LresultFromObject

gdi32

DeleteDC

winspool.drv

OpenPrinterW

oleaut32

VariantClear

Sections

.text
Size: 296KB - Virtual size: 500KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE