Static task
static1
Behavioral task
behavioral1
Sample
NEAS.04233f1d60301e65962b0b902cf65460_JC.exe
Resource
win7-20231020-en
General
-
Target
NEAS.04233f1d60301e65962b0b902cf65460_JC.exe
-
Size
521KB
-
MD5
04233f1d60301e65962b0b902cf65460
-
SHA1
48592e000afebbd6cc90a47ee9d97cd9bed4439b
-
SHA256
80af76a9a8dfc131634bab6b7f334b5ca488b63d719f78c31438407ac0e0a631
-
SHA512
b8c957532e9f26451eabdacee4f10e57036382b7fede5651176dc7f72695668268490f3a8e7738d0e63ad1a6967f973343e1a78f2a5849d719f850ad2cd5c13f
-
SSDEEP
12288:EL5C4kgGcwW9j3QT4JU1kuLeeKLh1WNrdw:ELTkgxwMja4JluLeeKL0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.04233f1d60301e65962b0b902cf65460_JC.exe
Files
-
NEAS.04233f1d60301e65962b0b902cf65460_JC.exe.exe windows:5 windows x86
52c719ab4616d8c4de1a13bd3c3232a1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WideCharToMultiByte
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
SetDllDirectoryA
InterlockedIncrement
InterlockedDecrement
GetCurrentProcessId
GetCurrentThreadId
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Sleep
LockFile
UnlockFile
LockFileEx
GetFileSize
WriteFile
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
GetSystemTime
CopyFileA
GetTickCount
FormatMessageA
LoadLibraryW
GetTempPathW
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetFullPathNameA
GetFullPathNameW
CreateFileA
CreateFileW
GetFileAttributesW
DeleteFileW
AreFileApisANSI
QueryPerformanceCounter
MultiByteToWideChar
DeleteFileA
GetTempPathA
GetEnvironmentVariableA
CreateProcessA
LoadLibraryA
lstrlenA
lstrcpynA
lstrcmpA
GetStdHandle
WaitForSingleObject
LocalFree
GetProcAddress
FreeLibrary
GetVersionExA
GetFileAttributesA
CloseHandle
GetLastError
HeapAlloc
GetCurrentProcess
GetProcessHeap
SetEnvironmentVariableA
WriteConsoleW
SetStdHandle
HeapSize
GetConsoleCP
OutputDebugStringW
HeapFree
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
RtlUnwind
HeapReAlloc
GetCommandLineA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetModuleFileNameW
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
LoadLibraryExW
GetFileType
ReadConsoleW
SetFilePointerEx
GetTimeZoneInformation
GetModuleFileNameA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
CompareStringW
LCMapStringW
advapi32
RegEnumValueA
CredFree
CredEnumerateA
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
shell32
SHGetFolderPathA
ole32
CoUninitialize
CoCreateInstance
CLSIDFromString
CoInitialize
crypt32
CryptUnprotectData
oleaut32
GetErrorInfo
Sections
.text Size: 443KB - Virtual size: 443KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ