NEAS[.]6ae059c1714f596694969beec09fecb0_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.6ae059c1714f596694969beec09fecb0_JC.exe
Size

146KB
MD5

6ae059c1714f596694969beec09fecb0
SHA1

887b24f831dce86beb5c3a103fbd91ef68432ae6
SHA256

0f316d6d3c3a90e451a8ada235264a4dce062b9c6f05c5d09edda572dacab9c7
SHA512

fb29f9c70123ff54daabfbba14577bd1f8800632b71218f229afd1d9a03f94228a3a9cc9542c2882147eb4977334b0cec9a640718e7984bfc436cf1e450c4435
SSDEEP

3072:Cv8HCTsPNlcxnWT+8kDU6GmzFgSaEeykMh:osREWTKGQeyTh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.6ae059c1714f596694969beec09fecb0_JC.exe

Files

NEAS.6ae059c1714f596694969beec09fecb0_JC.exe
.dll windows:4 windows x64

eedc78e365979ccf5e095071e7bfd4d8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetEnvironmentVariableA
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery

msvcrt

__dllonexit
__iob_func
_amsg_exit
_fdopen
_initterm
_lock
_onexit
_open
_stat64
_unlock
abort
atoi
calloc
fclose
fgets
fopen
fputc
fputs
free
fwrite
isalnum
isalpha
isspace
malloc
memcmp
memcpy
memset
signal
strcat
strchr
strcmp
strcpy
strlen
strncat
strncmp
strncpy
strrchr
strstr
tolower
toupper
vfprintf
_putenv
_close

libnspr4

PR_Access
PR_CallOnce
PR_Calloc
PR_Delete
PR_DestroyCondVar
PR_DestroyLock
PR_ErrorInstallTable
PR_ExplodeTime
PR_FormatTime
PR_Free
PR_GMTParameters
PR_GetCurrentThread
PR_GetDirectorySeparator
PR_GetEnv
PR_GetError
PR_GetLibraryFilePathname
PR_ImplodeTime
PR_LoadLibraryWithFlags
PR_LocalTimeParameters
PR_Lock
PR_Malloc
PR_NewCondVar
PR_NewLock
PR_NotifyAllCondVar
PR_NotifyCondVar
PR_Realloc
PR_Rename
PR_SetError
PR_Unlock
PR_WaitCondVar
PR_smprintf
PR_smprintf_free

libplc4

PL_strcasecmp
PL_strlen
PL_strncasecmp
PL_strpbrk

libplds4

PL_ArenaAllocate
PL_ArenaGrow
PL_ArenaRelease
PL_ClearArenaPool
PL_CompareValues
PL_FinishArenaPool
PL_FreeArenaPool
PL_HashTableAdd
PL_HashTableDestroy
PL_HashTableLookup
PL_HashTableLookupConst
PL_InitArenaPool
PL_NewHashTable

Exports

Exports

ATOB_AsciiToData_Util
ATOB_ConvertAsciiToItem_Util
BTOA_ConvertItemToAscii_Util
BTOA_DataToAscii_Util
CERT_GenTime2FormattedAscii_Util
CERT_UTCTime2FormattedAscii
DER_AsciiToTime_Util
DER_DecodeTimeChoice_Util
DER_EncodeTimeChoice_Util
DER_Encode_Util
DER_GeneralizedDayToAscii_Util
DER_GeneralizedTimeToTime_Util
DER_GetInteger_Util
DER_GetUInteger
DER_LengthLength
DER_Lengths_Util
DER_SetInteger
DER_SetUInteger
DER_StoreHeader
DER_TimeChoiceDayToAscii_Util
DER_TimeToGeneralizedTimeArena_Util
DER_TimeToGeneralizedTime_Util
DER_TimeToUTCTimeArena
DER_TimeToUTCTime_Util
DER_UTCDayToAscii_Util
DER_UTCTimeToAscii_Util
DER_UTCTimeToTime_Util
NSSBase64Decoder_Create_Util
NSSBase64Decoder_Destroy_Util
NSSBase64Decoder_Update_Util
NSSBase64Encoder_Create_Util
NSSBase64Encoder_Destroy_Util
NSSBase64Encoder_Update_Util
NSSBase64_DecodeBuffer_Util
NSSBase64_EncodeItem_Util
NSSRWLock_Destroy_Util
NSSRWLock_HaveWriteLock_Util
NSSRWLock_LockRead_Util
NSSRWLock_LockWrite_Util
NSSRWLock_New_Util
NSSRWLock_UnlockRead_Util
NSSRWLock_UnlockWrite_Util
NSSUTIL_ArgDecodeNumber
NSSUTIL_ArgFetchValue
NSSUTIL_ArgFindEnd
NSSUTIL_ArgGetLabel
NSSUTIL_ArgGetPair
NSSUTIL_ArgGetParamValue
NSSUTIL_ArgHasFlag
NSSUTIL_ArgIsBlank
NSSUTIL_ArgIsEscape
NSSUTIL_ArgIsQuote
NSSUTIL_ArgNextFlag
NSSUTIL_ArgParseCipherFlags
NSSUTIL_ArgParseModuleSpec
NSSUTIL_ArgParseSlotFlags
NSSUTIL_ArgParseSlotInfo
NSSUTIL_ArgReadLong
NSSUTIL_ArgSkipParameter
NSSUTIL_ArgStrip
NSSUTIL_DoModuleDBFunction
NSSUTIL_DoubleEscape
NSSUTIL_DoubleEscapeSize
NSSUTIL_Escape
NSSUTIL_EscapeSize
NSSUTIL_GetVersion
NSSUTIL_MkModuleSpec
NSSUTIL_MkNSSString
NSSUTIL_MkSlotString
NSSUTIL_Quote
NSSUTIL_QuoteSize
NSS_GetAlgorithmPolicy
NSS_Get_SECOID_AlgorithmIDTemplate_Util
NSS_Get_SEC_AnyTemplate_Util
NSS_Get_SEC_BMPStringTemplate_Util
NSS_Get_SEC_BitStringTemplate_Util
NSS_Get_SEC_BooleanTemplate_Util
NSS_Get_SEC_EnumeratedTemplate
NSS_Get_SEC_GeneralizedTimeTemplate_Util
NSS_Get_SEC_IA5StringTemplate_Util
NSS_Get_SEC_IntegerTemplate_Util
NSS_Get_SEC_NullTemplate_Util
NSS_Get_SEC_ObjectIDTemplate_Util
NSS_Get_SEC_OctetStringTemplate_Util
NSS_Get_SEC_PointerToAnyTemplate_Util
NSS_Get_SEC_PointerToEnumeratedTemplate
NSS_Get_SEC_PointerToGeneralizedTimeTemplate
NSS_Get_SEC_PointerToOctetStringTemplate_Util
NSS_Get_SEC_PrintableStringTemplate
NSS_Get_SEC_SequenceOfAnyTemplate
NSS_Get_SEC_SequenceOfObjectIDTemplate
NSS_Get_SEC_SetOfAnyTemplate_Util
NSS_Get_SEC_SkipTemplate
NSS_Get_SEC_T61StringTemplate
NSS_Get_SEC_UTCTimeTemplate_Util
NSS_Get_SEC_UTF8StringTemplate_Util
NSS_Get_SEC_UniversalStringTemplate
NSS_Get_sgn_DigestInfoTemplate_Util
NSS_InitializePRErrorTable
NSS_PutEnv_Util
NSS_SecureMemcmp
NSS_SetAlgorithmPolicy
PORT_Alloc_Util
PORT_ArenaAlloc_Util
PORT_ArenaGrow_Util
PORT_ArenaMark_Util
PORT_ArenaRelease_Util
PORT_ArenaStrdup_Util
PORT_ArenaUnmark_Util
PORT_ArenaZAlloc_Util
PORT_ArenaZRelease
PORT_FreeArena_Util
PORT_Free_Util
PORT_GetError_Util
PORT_ISO88591_UTF8Conversion
PORT_LoadLibraryFromOrigin
PORT_NewArena_Util
PORT_Realloc_Util
PORT_RegExpCaseSearch
PORT_RegExpSearch
PORT_RegExpValid
PORT_SetError_Util
PORT_SetUCS2_ASCIIConversionFunction_Util
PORT_SetUCS2_UTF8ConversionFunction_Util
PORT_SetUCS4_UTF8ConversionFunction_Util
PORT_Strdup_Util
PORT_UCS2_ASCIIConversion_Util
PORT_UCS2_UTF8Conversion_Util
PORT_UCS4_UTF8Conversion
PORT_ZAlloc_Util
PORT_ZFree_Util
SECITEM_AllocArray
SECITEM_AllocItem_Util
SECITEM_ArenaDupItem_Util
SECITEM_CompareItem_Util
SECITEM_CopyItem_Util
SECITEM_DupArray
SECITEM_DupItem_Util
SECITEM_FreeArray
SECITEM_FreeItem_Util
SECITEM_Hash
SECITEM_HashCompare
SECITEM_ItemsAreEqual_Util
SECITEM_ReallocItem
SECITEM_ReallocItemV2
SECITEM_ZfreeArray
SECITEM_ZfreeItem_Util
SECOID_AddEntry_Util
SECOID_AlgorithmIDTemplate_Util
SECOID_CompareAlgorithmID_Util
SECOID_CopyAlgorithmID_Util
SECOID_DestroyAlgorithmID_Util
SECOID_FindOIDByMechanism
SECOID_FindOIDByTag_Util
SECOID_FindOIDTagDescription_Util
SECOID_FindOIDTag_Util
SECOID_FindOID_Util
SECOID_GetAlgorithmTag_Util
SECOID_Init
SECOID_KnownCertExtenOID
SECOID_SetAlgorithmID_Util
SECOID_Shutdown
SEC_ASN1DecodeInteger_Util
SEC_ASN1DecodeItem_Util
SEC_ASN1Decode_Util
SEC_ASN1DecoderAbort_Util
SEC_ASN1DecoderClearFilterProc_Util
SEC_ASN1DecoderClearNotifyProc_Util
SEC_ASN1DecoderFinish_Util
SEC_ASN1DecoderSetFilterProc_Util
SEC_ASN1DecoderSetNotifyProc_Util
SEC_ASN1DecoderStart_Util
SEC_ASN1DecoderUpdate_Util
SEC_ASN1EncodeInteger_Util
SEC_ASN1EncodeItem_Util
SEC_ASN1EncodeLength
SEC_ASN1EncodeUnsignedInteger_Util
SEC_ASN1Encode_Util
SEC_ASN1EncoderAbort_Util
SEC_ASN1EncoderClearNotifyProc_Util
SEC_ASN1EncoderClearStreaming_Util
SEC_ASN1EncoderClearTakeFromBuf_Util
SEC_ASN1EncoderFinish_Util
SEC_ASN1EncoderSetNotifyProc_Util
SEC_ASN1EncoderSetStreaming_Util
SEC_ASN1EncoderSetTakeFromBuf_Util
SEC_ASN1EncoderStart_Util
SEC_ASN1EncoderUpdate_Util
SEC_ASN1GetSubtemplate
SEC_ASN1IsTemplateSimple
SEC_ASN1LengthLength_Util
SEC_AnyTemplate_Util
SEC_BMPStringTemplate_Util
SEC_BitStringTemplate_Util
SEC_BooleanTemplate_Util
SEC_EnumeratedTemplate
SEC_GeneralizedTimeTemplate_Util
SEC_IA5StringTemplate_Util
SEC_IntegerTemplate_Util
SEC_NullTemplate_Util
SEC_ObjectIDTemplate_Util
SEC_OctetStringTemplate_Util
SEC_PointerToAnyTemplate_Util
SEC_PointerToEnumeratedTemplate
SEC_PointerToGeneralizedTimeTemplate
SEC_PointerToOctetStringTemplate_Util
SEC_PrintableStringTemplate
SEC_QuickDERDecodeItem_Util
SEC_SequenceOfAnyTemplate
SEC_SequenceOfObjectIDTemplate
SEC_SetOfAnyTemplate_Util
SEC_SetOfEnumeratedTemplate
SEC_SkipTemplate
SEC_StringToOID
SEC_T61StringTemplate
SEC_UTCTimeTemplate_Util
SEC_UTF8StringTemplate_Util
SEC_UniversalStringTemplate
SEC_VisibleStringTemplate
SGN_CompareDigestInfo_Util
SGN_CopyDigestInfo_Util
SGN_CreateDigestInfo_Util
SGN_DecodeDigestInfo
SGN_DestroyDigestInfo_Util
SGN_EncodeDigestInfo
UTIL_SetForkState
_NSSUTIL_EvaluateConfigDir
_NSSUTIL_GetSecmodName
_SGN_VerifyPKCS1DigestInfo
__nss_util_rcsid
__nss_util_sccsid
lfopen
port_allocFailures
sec_asn1d_uinteger
sec_port_iso88591_utf8_conversion_function
sec_port_ucs2_utf8_conversion_function
sec_port_ucs4_utf8_conversion_function
sgn_DigestInfoTemplate_Util
ucs2AsciiConvertFunc
ucs2Utf8ConvertFunc
ucs4Utf8ConvertFunc

Sections

.text
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.buildid
Size: 512B - Virtual size: 53B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eedc78e365979ccf5e095071e7bfd4d8

Headers

File Characteristics

Imports

kernel32

msvcrt

libnspr4

libplc4

libplds4

Exports

Exports

Sections

.text Size: 63KB - Virtual size: 62KB

.data Size: 512B - Virtual size: 104B

.rdata Size: 51KB - Virtual size: 51KB

.buildid Size: 512B - Virtual size: 53B

.pdata Size: 4KB - Virtual size: 3KB

.xdata Size: 3KB - Virtual size: 3KB

.bss Size: - Virtual size: 3KB

.edata Size: 8KB - Virtual size: 8KB

.idata Size: 4KB - Virtual size: 4KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 104B

.rsrc Size: 1024B - Virtual size: 768B

.reloc Size: 2KB - Virtual size: 2KB

/4 Size: 512B - Virtual size: 24B

.text
Size: 63KB - Virtual size: 62KB

.data
Size: 512B - Virtual size: 104B

.rdata
Size: 51KB - Virtual size: 51KB

.buildid
Size: 512B - Virtual size: 53B

.pdata
Size: 4KB - Virtual size: 3KB

.xdata
Size: 3KB - Virtual size: 3KB

.bss
Size: - Virtual size: 3KB

.edata
Size: 8KB - Virtual size: 8KB

.idata
Size: 4KB - Virtual size: 4KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 104B

.rsrc
Size: 1024B - Virtual size: 768B

.reloc
Size: 2KB - Virtual size: 2KB

/4
Size: 512B - Virtual size: 24B