NEAS[.]03baea843c425317f511f418ebd285d0_JC[.]exe | Triage

Sharing

General

Target

NEAS.03baea843c425317f511f418ebd285d0_JC.exe
Size

212KB
MD5

03baea843c425317f511f418ebd285d0
SHA1

57da268589ee5e70225499bbb801055bc5fb2db4
SHA256

f57d0aa963166bb5410084a688db6f63fc768741f90740a9dc09203737d68b51
SHA512

087e376e0cdd099029e3a374ac9e65b2d83ace73e484edd5a2bc70f67244219c7645c4baf3c7ad94800e61a3e87792d635a4f0dc39216bf8d6b150e528bce28f
SSDEEP

3072:GTJE+ICUQRMhMFjfoPDpwT039Zc0HZwxI5YUA2h+D+5dOIWF79sTYio/Hr8r6OY3:GTc3MZ2/39ZnZ4UKyDOIY9skio/L4A

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.03baea843c425317f511f418ebd285d0_JC.exe

Files

NEAS.03baea843c425317f511f418ebd285d0_JC.exe
.exe windows:5 windows x86

9200c812daf123b83111e8ee3e4dd4a2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegQueryValueExW
RegOpenKeyW

quartz

DBToAmpFactor
AMGetErrorTextA
DllRegisterServer
DllUnregisterServer
DllGetClassObject
AMGetErrorTextW
AmpFactorToDB
DllCanUnloadNow

kernel32

DeviceIoControl
GetLocaleInfoW
SetLastError
FindResourceA
GetLocalTime
lstrlenA
FreeResource
GetOEMCP
QueryPerformanceCounter
HeapFree
LoadResource
GetProcessHeap
LockResource
CloseHandle
HeapAlloc
CreateFileA
MultiByteToWideChar
SystemTimeToFileTime
GetCurrentProcess
LoadLibraryW
GetUserDefaultLCID
GetVolumeInformationA
SetUnhandledExceptionFilter
QueryDosDeviceA
GetCurrentProcessId
lstrcmpA
GetEnvironmentStringsW
GetTickCount
lstrcpyA
WideCharToMultiByte
GetSystemDefaultLCID
GetSystemTimeAsFileTime

user32

wsprintfA
CharNextA

Sections

.text
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 6.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ