NEAS[.]aba97d99e94f5c5c2e4931abe6cbbcb0_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.aba97d99e94f5c5c2e4931abe6cbbcb0_JC.exe
Size

90KB
MD5

aba97d99e94f5c5c2e4931abe6cbbcb0
SHA1

4bdf024dc380644e530faeb66c67e8d01ecf170e
SHA256

cd03bb951b2c0414ae1eb522560e073630ebe8e5e3f0d7053ffdd27c040c4393
SHA512

5b1d6176ad4b8469f113181428fb18f35c557ac702bc8142ce7ec53e5979e110ac612fdf478671c78ef855e27a42726aab28ca1b8d65467d68a0c21ceec41679
SSDEEP

1536:2myFN56qx27GEpv7haReb8DeUDDMf7U03yybUVNk3i62u6fZY:2mujx2rpv7y9b04QRUVNkr6B

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.aba97d99e94f5c5c2e4931abe6cbbcb0_JC.exe

Files

NEAS.aba97d99e94f5c5c2e4931abe6cbbcb0_JC.exe
.exe windows:5 windows x86

b6e86f6c6d2ad43eb9e587bdcf524c17

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TerminateThread
LoadLibraryA
DeleteFileW
HeapReAlloc
GetNativeSystemInfo
CreateThread
HeapAlloc
HeapDestroy
VirtualAllocEx
LocalFree
DeleteCriticalSection
GetComputerNameW
GetProcessHeap
SystemTimeToFileTime
GlobalMemoryStatusEx
CreateProcessW
WideCharToMultiByte
InterlockedIncrement
GetSystemTime
VirtualFreeEx
IsBadReadPtr
lstrcmpiW
OpenMutexW
SetEndOfFile
GetCurrentThread
FlushFileBuffers
RemoveVectoredExceptionHandler
GetCurrentProcess
SetErrorMode
GetVersionExW
DuplicateHandle
GetModuleHandleA
AddVectoredExceptionHandler
ExitProcess
GetCurrentProcessId
CopyFileW
lstrcmpiA
IsWow64Process
FindFirstChangeNotificationW
FindNextChangeNotification
IsProcessInJob
CreateRemoteThread
CreateNamedPipeW
DisconnectNamedPipe
ConnectNamedPipe
GetLogicalDrives
GetDriveTypeW
GetUserDefaultUILanguage
CopyFileExW
GetEnvironmentVariableW
SetFilePointer
InitializeCriticalSection
GetTimeZoneInformation
MultiByteToWideChar
SetFileAttributesW
GetVolumeNameForVolumeMountPointW
OpenProcess
GetFileTime
ReleaseMutex
LeaveCriticalSection
GetModuleFileNameW
SetFileTime
RemoveDirectoryW
VirtualAlloc
ExpandEnvironmentStringsW
WriteFile
FindNextFileW
EnterCriticalSection
GetFileAttributesW
FindClose
OpenEventW
GetTempPathW
SetLastError
HeapFree
HeapCreate
WriteProcessMemory
GetFileSizeEx
FindFirstFileW
InterlockedExchange
GetVolumeInformationW
ReadFile
CreateDirectoryW
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryW
Process32FirstW
Process32NextW
GetLastError
CreateToolhelp32Snapshot
CreateFileW
CreateMutexW
ResetEvent
CloseHandle
SetEvent
Sleep
CreateEventW
WaitForSingleObject
WaitForMultipleObjects
GetTickCount
VirtualFree

user32

GetIconInfo
DrawIcon
LoadImageW
GetCursorPos
DefWindowProcW
CreateWindowExW
UnregisterClassW
GetKeyboardLayoutList
CharLowerA
CharToOemW
TranslateMessage
PeekMessageW
DispatchMessageW
MsgWaitForMultipleObjects
RegisterClassExW
SetWindowLongA
GetWindowLongA
CharUpperW
DestroyWindow

crypt32

CryptImportPublicKeyInfo
CryptDecodeObjectEx

advapi32

RegCloseKey
GetAce
CryptEncrypt
GetSidSubAuthorityCount
AllocateAndInitializeSid
GetSidSubAuthority
SetEntriesInAclW
RegCreateKeyExW
CryptVerifySignatureW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
CryptCreateHash
CryptHashData
SetSecurityDescriptorSacl
RegSetValueExW
CryptDestroyHash
OpenProcessToken
FreeSid
InitializeSecurityDescriptor
RegOpenKeyExW
CryptImportKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenThreadToken
RegQueryValueExW
CryptReleaseContext
GetTokenInformation
CryptDestroyKey
AdjustTokenPrivileges
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
LookupPrivilegeValueW
GetLengthSid
RegDeleteValueW
RegFlushKey
RegNotifyChangeKeyValue
RegQueryInfoKeyW
RegEnumKeyW
InitiateSystemShutdownExW
CryptAcquireContextW

shell32

ShellExecuteW
ShellExecuteExW
SHGetFolderPathW

shlwapi

PathFileExistsW
PathIsURLW
PathIsDirectoryEmptyW
StrCmpNIW
PathRenameExtensionW
StrStrIW
PathMatchSpecW
PathCombineW
PathRemoveFileSpecW
PathAddBackslashW
wvnsprintfW
PathUnquoteSpacesW
PathSkipRootW
PathFindExtensionW
SHDeleteValueW
wvnsprintfA
PathIsDirectoryW
PathRemoveBackslashW
UrlUnescapeA
PathQuoteSpacesW

psapi

GetModuleFileNameExW

ole32

CLSIDFromString
CoInitializeEx
CreateStreamOnHGlobal
CoSetProxyBlanket
CoCreateInstance
CoUninitialize

gdi32

DeleteObject
GetDeviceCaps
CreateDCW
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
BitBlt
DeleteDC

wininet

InternetConnectA
InternetReadFile
HttpQueryInfoA
InternetQueryOptionA
HttpOpenRequestA
InternetCrackUrlA
InternetSetOptionA
InternetOpenA
InternetCloseHandle
HttpSendRequestA

urlmon

ObtainUserAgentString

oleaut32

VariantClear

secur32

GetUserNameExW

Sections

.text
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b6e86f6c6d2ad43eb9e587bdcf524c17

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

crypt32

advapi32

shell32

shlwapi

psapi

ole32

gdi32

wininet

urlmon

oleaut32

secur32

Sections

.text Size: 61KB - Virtual size: 60KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 14KB - Virtual size: 26KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 61KB - Virtual size: 60KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 14KB - Virtual size: 26KB

.reloc
Size: 3KB - Virtual size: 3KB