NEAS[.]13e6bd8d48964cf070705e2e2fd3a210_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.13e6bd8d48964cf070705e2e2fd3a210_JC.exe
Size

63KB
MD5

13e6bd8d48964cf070705e2e2fd3a210
SHA1

c1f4b953683866efc4215b590f205ad94e304c83
SHA256

0b4d175c45d1180f9ae6fd378304b512d5ac1c1522df80eebf9f8a94c899375f
SHA512

2a6bd3796ed6592919bda3a290dc1daf5723e07be5f3956d172c21986c3307c1d0ff000a6da0ae9b6f6c8101f5d6dbcf050a3518c3a7ca40b8eb76a4901d4d37
SSDEEP

1536:4RWJlxQFJpDPdxtyoyRg0Cl8IRQ06DnZTfQXmpmF7rv4caP9rsuNcAq:4RW/xQFJ5Pdxty/JIRR6DxfQ2pmF7sct

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.13e6bd8d48964cf070705e2e2fd3a210_JC.exe

Files

NEAS.13e6bd8d48964cf070705e2e2fd3a210_JC.exe
.exe windows:4 windows x86

eec9df3946d15f28ba1ebb7e791a8f25

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommMask
CompareStringW
InterlockedCompareExchange
Heap32Next
_hwrite
EnumDateFormatsExW
CreateSemaphoreA
GetCommandLineA
GetConsoleCommandHistoryLengthW
EndUpdateResourceW
ScrollConsoleScreenBufferW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 49KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE