NEAS[.]472223689d8bc757f4d020bd6dbf2ff0_JC[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.472223689d8bc757f4d020bd6dbf2ff0_JC.exe
Size

11KB
MD5

472223689d8bc757f4d020bd6dbf2ff0
SHA1

1ad587252a368d582a9b5d271c1839227711275b
SHA256

0ea40fea510cebbd7c1654e313beb2b537beb0b1312046271d7c04732c0cc19a
SHA512

94372e1f077118531fb669cb04264ace13f9c972eb64c37b916c33f6d91dc9d188556df9e5bd218c3647de8504e83e00916bff7b31bd6f133965f5d105966bf9
SSDEEP

192:gzYUUs0K1p0OdlrgSaq64VKtIcDrNINYejdjkNW:gzEOdAIcIJJ

Score

1^/10

Malware Config

Signatures

Files

NEAS.472223689d8bc757f4d020bd6dbf2ff0_JC.exe
.sys windows:10 windows x64

dbea4d62d6987324655f00cd89a187ae

Code Sign

38:19:f9:a7:81:81:98:8e:4e:b3:63:2d:f2:4e:83:16
Certificate

Issuer

CN=WDKTestCert home\,133407836005333458

Not Before

03-10-2023 05:13

Not After

03-10-2033 00:00

Subject

CN=WDKTestCert home\,133407836005333458

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageKeyEncipherment
KeyUsageDataEncipherment

51:af:42:9b:02:33:55:8b:f9:89:67:51:6a:60:66:db:3f:1c:56:eb:a9:a2:d1:f0:96:bb:89:ff:42:43:74:bc
Signer

Actual PE Digest

51:af:42:9b:02:33:55:8b:f9:89:67:51:6a:60:66:db:3f:1c:56:eb:a9:a2:d1:f0:96:bb:89:ff:42:43:74:bc

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

RtlGetVersion
ExAllocatePoolWithTag
ExFreePoolWithTag
MmUnmapIoSpace
MmMapIoSpaceEx
ObfDereferenceObject
MmCopyMemory
PsLookupProcessByProcessId
ZwQuerySystemInformation
PsGetProcessSectionBaseAddress

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 512B - Virtual size: 370B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dbea4d62d6987324655f00cd89a187ae

Code Sign

38:19:f9:a7:81:81:98:8e:4e:b3:63:2d:f2:4e:83:16Certificate

Extended Key Usages

Key Usages

51:af:42:9b:02:33:55:8b:f9:89:67:51:6a:60:66:db:3f:1c:56:eb:a9:a2:d1:f0:96:bb:89:ff:42:43:74:bcSigner

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 5KB - Virtual size: 4KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 32B

.pdata Size: 512B - Virtual size: 252B

INIT Size: 512B - Virtual size: 370B

.reloc Size: 512B - Virtual size: 36B

38:19:f9:a7:81:81:98:8e:4e:b3:63:2d:f2:4e:83:16
Certificate

51:af:42:9b:02:33:55:8b:f9:89:67:51:6a:60:66:db:3f:1c:56:eb:a9:a2:d1:f0:96:bb:89:ff:42:43:74:bc
Signer

.text
Size: 5KB - Virtual size: 4KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 32B

.pdata
Size: 512B - Virtual size: 252B

INIT
Size: 512B - Virtual size: 370B

.reloc
Size: 512B - Virtual size: 36B