NEAS[.]035749749cfc80699dcad8a7ba81c950_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.035749749cfc80699dcad8a7ba81c950_JC.exe
Size

81KB
MD5

035749749cfc80699dcad8a7ba81c950
SHA1

5659260e4ad9fb5667f0a1ba76d1e3e0bd20f7fa
SHA256

56ab26ef46f1660cc4b273c3ce395348ae047892d4c848459095048de25f0e39
SHA512

961abc9e6c2452c5f8ab82d7e3d579b23d2f65e3bf7967a0220dcf7744016749476482168da5a9f4b1bb50d406c1c903c2297f68cb5d81f31f17c82d82e955ec
SSDEEP

1536:Iu2dp8XIy2otH+XeSf6RDSarAxvA/XtgP7QFnqXpATKQfkZNCyGv+HND:IpHbrot5HRDSarAhegDKnqXpaKJZsH+t

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.035749749cfc80699dcad8a7ba81c950_JC.exe

Files

NEAS.035749749cfc80699dcad8a7ba81c950_JC.exe
.dll windows:4 windows x86

67cd87f281238b7baefdb8216513415e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

vcl50.bpl

@System@initialization$qqrv

vclx50.bpl

@Filectrl@initialization$qqrv

vcldb50.bpl

@Dbconsts@initialization$qqrv

vclbde50.bpl

@Bde@initialization$qqrv

qrpt50.bpl

@Qr3const@initialization$qqrv

ehlibb50.bpl

@Toolctrlseh@Finalization$qqrv

tuxedo.bpl

@Msxml_tlb@Finalization$qqrv

fc4000v5.bpl

@Fcgraphics@initialization$qqrv

ip4000v5.bpl

@Wwstr@initialization$qqrv

advctrls.bpl

@@Checktreeview@Finalize

basiclistprint.bpl

@@Dbgridprinter@Finalize

syscomm

@TMsgUtil@MsgBoxError$qpvrx17System@AnsiString

user32

EnumThreadWindows

oleaut32

VariantInit

Exports

Exports

@@Pm_common@Finalize
@@Pm_common@Initialize
@@Pm_producttypemanager@Finalize
@@Pm_producttypemanager@Initialize
@@Pub_syslog@Finalize
@@Pub_syslog@Initialize
@@Pub_sysmainproxy@Finalize
@@Pub_sysmainproxy@Initialize
@@Pub_sysorgproxy@Finalize
@@Pub_sysorgproxy@Initialize
@System@TMetaClass@ClassName$qqrv
@System@TMetaClass@ClassParent$qqrv
@System@TObject@ClassNameIs$qqrx17System@AnsiString
@System@TObject@ClassNameIs$qqrx17System@AnsiString
@System@TObject@ClassNameIs$qqrx17System@AnsiString
@System@TObject@ClassParent$qqrv
___CPPdebugHook
fnDllService
fnDllUnload
fnGetDllBuildno

Sections

.text
Size: 75KB - Virtual size: 316KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

67cd87f281238b7baefdb8216513415e

Headers

File Characteristics

Imports

kernel32

vcl50.bpl

vclx50.bpl

vcldb50.bpl

vclbde50.bpl

qrpt50.bpl

ehlibb50.bpl

tuxedo.bpl

fc4000v5.bpl

ip4000v5.bpl

advctrls.bpl

basiclistprint.bpl

syscomm

user32

oleaut32

Exports

Exports

Sections

.text Size: 75KB - Virtual size: 316KB

.rsrc Size: 5KB - Virtual size: 8KB

.reloc Size: 512B - Virtual size: 512B

.text
Size: 75KB - Virtual size: 316KB

.rsrc
Size: 5KB - Virtual size: 8KB

.reloc
Size: 512B - Virtual size: 512B