NEAS[.]ecdfa9e8d84b7b3ebe2e2a0c9284a360_JC[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.ecdfa9e8d84b7b3ebe2e2a0c9284a360_JC.exe
Size

410KB
MD5

ecdfa9e8d84b7b3ebe2e2a0c9284a360
SHA1

83dfbc3ddfbfa2adebed509960dfec74be9c9feb
SHA256

9ab9b9604b845a2e71aa51a053af83b149f13d5d8110c6fe9e9c79e2482251a8
SHA512

c3a229b123dd1a676356004a5d759fca204e5aa8570e1b4e1222ea81e71dfe0076bb6f3b7af1167fa488452e3c8759098afb39e42524ceed71fecb6baae60103
SSDEEP

6144:XGhexK2e9vcw7Q19WxhHT5k5JdurFCCJApCnlvLt8kEFamSWlyxlkgg0kIe7m28y:XoeA2gvi4lKkD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.ecdfa9e8d84b7b3ebe2e2a0c9284a360_JC.exe

Files

NEAS.ecdfa9e8d84b7b3ebe2e2a0c9284a360_JC.exe
.dll regsvr32 windows:10 windows x64

132f4276646ae583a38844b18c79d991

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_XcptFilter
_amsg_exit
_initterm
sscanf_s
_purecall
swscanf_s
memmove_s
_wtof
malloc
__C_specific_handler
wcsncpy_s
memset
??1type_info@@UEAA@XZ
strtol
_wcsicmp
free
wcsstr
_errno
_vsnwprintf
realloc
memcpy_s
wcscpy_s
_vscwprintf
towupper
_wtol
_lock
_unlock
__dllonexit
_wcstoi64
memcmp
iswspace
floor
wcscat_s
wcstod
calloc
strtoul
wcschr
wcsrchr
__CxxFrameHandler3
vswprintf_s
_CxxThrowException
wcstok
_onexit
memcpy

propsys

InitPropVariantFromStringAsVector
PropVariantCompareEx
PropVariantGetElementCount
InitPropVariantFromStringVector
PropVariantChangeType

rpcrt4

CStdStubBuffer_AddRef
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrOleAllocate
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
NdrDllUnregisterProxy
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrDllRegisterProxy
NdrCStdStubBuffer_Release
CStdStubBuffer_Connect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported

windowscodecs

WICConvertBitmapSource

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-file-l1-1-0

FileTimeToSystemTime
GetTempFileNameW
DeleteFileW

api-ms-win-shcore-unicodeansi-l1-1-0

SHAnsiToUnicode
SHUnicodeToAnsi

api-ms-win-shcore-stream-l1-1-0

SHCreateStreamOnFileW

api-ms-win-core-synch-l1-2-0

LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
Sleep

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-com-l1-1-1

PropVariantClear
PropVariantCopy
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
StringFromGUID2
CoGetMalloc
CreateStreamOnHGlobal
CLSIDFromString
CoTaskMemFree

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
GetTraceEnableLevel
TraceEvent
GetTraceEnableFlags
GetTraceLoggerHandle
UnregisterTraceGuids

api-ms-win-core-libraryloader-l1-2-0

SizeofResource
LoadResource
GetModuleHandleW
LoadLibraryExW
GetModuleFileNameW
FreeLibrary
GetProcAddress
LockResource
FindResourceExW
LoadLibraryExA
DisableThreadLibraryCalls

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-errorhandling-l1-1-1

RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumKeyExW
RegEnumValueW
RegQueryValueExW
RegCloseKey

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
CompareStringW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime

api-ms-win-core-file-l1-2-1

GetTempPathW

api-ms-win-core-localization-l1-2-1

GetSystemDefaultLCID

api-ms-win-core-heap-l1-2-0

HeapSize
HeapDestroy
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentProcessId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-debug-l1-1-1

OutputDebugStringA

api-ms-win-core-kernel32-legacy-l1-1-1

MulDiv

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW
lstrcmpW
lstrlenA
lstrcmpiW

api-ms-win-core-localization-obsolete-l1-3-0

CompareStringA

api-ms-win-core-shlwapi-obsolete-l1-2-0

StrTrimW

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 143KB - Virtual size: 142KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 242KB - Virtual size: 241KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

132f4276646ae583a38844b18c79d991

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

propsys

rpcrt4

windowscodecs

ntdll

api-ms-win-core-file-l1-1-0

api-ms-win-shcore-unicodeansi-l1-1-0

api-ms-win-shcore-stream-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-localization-l1-2-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-localization-obsolete-l1-3-0

api-ms-win-core-shlwapi-obsolete-l1-2-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 143KB - Virtual size: 142KB

.rdata Size: 242KB - Virtual size: 241KB

.data Size: 3KB - Virtual size: 5KB

.pdata Size: 8KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 120B

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 143KB - Virtual size: 142KB

.rdata
Size: 242KB - Virtual size: 241KB

.data
Size: 3KB - Virtual size: 5KB

.pdata
Size: 8KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 120B

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 7KB - Virtual size: 7KB