NEAS[.]204b43879e0822b2ea563cdec8d4f390_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.204b43879e0822b2ea563cdec8d4f390_JC.exe
Size

324KB
MD5

204b43879e0822b2ea563cdec8d4f390
SHA1

b07b429b68b49f1f4e31b7ed84fc506889c2ea6c
SHA256

6cfb4bfb06568e2542b5b3b7a1cd8dac8b7938ec3942ae314a2ff40f81047c54
SHA512

0914d5ce786e2c887fb7a654fccef544c644c593a4ba3c5109f90f0d1e21b025273486341f012b5a7472706cb583d89ee953849145ed749b40ed55d83f34ef4c
SSDEEP

3072:9lLbNyd9eJbLfhNRcQRShGenpheOJGRu5A+RUGAw5+YEmXrW11lYe:npLcQnKpheOJU6AwsRmXrWKe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.204b43879e0822b2ea563cdec8d4f390_JC.exe

Files

NEAS.204b43879e0822b2ea563cdec8d4f390_JC.exe
.exe windows:4 windows x86

c7c39add1a3d332abb0135389487c709

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Process32First
CreateToolhelp32Snapshot
GetLastError
CreateMutexA
Process32Next
MultiByteToWideChar
Sleep
RaiseException
LocalFree
OpenProcess
TerminateProcess
CloseHandle
lstrlenA
GetModuleFileNameA
InterlockedDecrement
CopyFileA
lstrlenW
FlushFileBuffers
LCMapStringW
LCMapStringA
SetStdHandle
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
IsBadCodePtr
SetUnhandledExceptionFilter
SetFilePointer
VirtualAlloc
HeapReAlloc
HeapAlloc
VirtualFree
HeapFree
RtlUnwind
ExitProcess
GetCurrentProcess
DebugBreak
GetStdHandle
WriteFile
OutputDebugStringA
GetProcAddress
LoadLibraryA
InterlockedIncrement
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
IsBadWritePtr
IsBadReadPtr
HeapValidate
SetConsoleCtrlHandler
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
ReadFile

user32

MessageBoxA

advapi32

RegOpenKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

shell32

ShellExecuteA

ole32

CoCreateInstance
CoInitialize
CoUninitialize
OleRun

oleaut32

CreateErrorInfo
GetErrorInfo
VariantChangeType
SetErrorInfo
VariantClear
SysAllocString
SysFreeString
VariantInit

wininet

InternetOpenA
InternetOpenUrlA
InternetCloseHandle
InternetReadFile

netapi32

Netbios

Sections

.text
Size: 248KB - Virtual size: 246KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 210KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c7c39add1a3d332abb0135389487c709

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

wininet

netapi32

Sections

.text Size: 248KB - Virtual size: 246KB

.rdata Size: 32KB - Virtual size: 31KB

.data Size: 24KB - Virtual size: 210KB

.idata Size: 4KB - Virtual size: 3KB

.reloc Size: 12KB - Virtual size: 8KB

.text
Size: 248KB - Virtual size: 246KB

.rdata
Size: 32KB - Virtual size: 31KB

.data
Size: 24KB - Virtual size: 210KB

.idata
Size: 4KB - Virtual size: 3KB

.reloc
Size: 12KB - Virtual size: 8KB