NEAS[.]1b2d4998e0f75c91d35caef2f5cca300_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.1b2d4998e0f75c91d35caef2f5cca300_JC.exe
Size

1.6MB
MD5

1b2d4998e0f75c91d35caef2f5cca300
SHA1

5f652bda4ae4aa3e15d087ffcfc4e72d84aa15ae
SHA256

9bd25fffe08af0dd99d8cf9e8db0135e24fd9ace50436a66f95400f83477482b
SHA512

1ddfa50399f3d0f76ac05bd53e688b79b5a028155af98aa2761fac5540d4e8bd9c7d9b24c0f8616b2d2d680d38248b1e726e65d3c0a0df4aa3b2c25182bddace
SSDEEP

49152:oXzsuk8Rc8PjOL05CoOfIpdme7s5Sz4lvLLNiXicJFFRGNzj3:szg7wRGpj3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.1b2d4998e0f75c91d35caef2f5cca300_JC.exe

Files

NEAS.1b2d4998e0f75c91d35caef2f5cca300_JC.exe
.exe windows:6 windows x64

714509d39dd11972911c7cc41426408a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GlobalFree
LoadLibraryW
ResetEvent
DeleteProcThreadAttributeList
HeapAlloc
K32EnumProcesses
GetCurrentDirectoryW
LocalFree
DeleteCriticalSection
GetProcessHeap
CreateProcessW
GetModuleHandleW
FreeLibrary
K32EnumProcessModules
OpenThread
LoadLibraryExW
GetExitCodeProcess
RtlCaptureStackBackTrace
GetSystemPowerStatus
GetLocalTime
GetSystemTime
SetThreadAffinityMask
FormatMessageW
GetCurrentThread
ReadFile
PurgeComm
BuildCommDCBW
GetCommState
SetCommState
FlushFileBuffers
CreateDirectoryW
UnlockFileEx
GetFileAttributesW
SetFilePointerEx
LockFileEx
SwitchToThread
QueryDosDeviceW
SetNamedPipeHandleState
CompareFileTime
FindFirstFileW
SetHandleInformation
FindNextFileW
SetProcessAffinityMask
TerminateProcess
K32GetProcessImageFileNameW
SetEnvironmentVariableW
GetExitCodeThread
GetEnvironmentVariableW
FindClose
OpenProcess
ResumeThread
UnmapViewOfFile
CreateToolhelp32Snapshot
GetMaximumProcessorCount
GetLogicalProcessorInformationEx
GetFileAttributesExW
Process32NextW
GetMaximumProcessorGroupCount
GetLogicalProcessorInformation
FileTimeToSystemTime
GetDiskFreeSpaceExW
TerminateThread
GlobalAlloc
Process32FirstW
GetSystemInfo
QueueUserAPC
GetThreadContext
SystemTimeToFileTime
QueryFullProcessImageNameW
CreateDirectoryA
CreateFileMappingW
MapViewOfFile
VirtualQuery
GetModuleFileNameA
VirtualProtect
GetEnvironmentVariableA
lstrcmpA
TryEnterCriticalSection
GetModuleHandleA
GetVersion
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
QueryThreadCycleTime
CreateFileW
LocalAlloc
SetErrorMode
InitializeCriticalSection
__C_specific_handler
UpdateProcThreadAttribute
CreatePipe
CancelWaitableTimer
K32GetModuleFileNameExW
GetProcessId
SetProcessShutdownParameters
SetLastError
InitializeProcThreadAttributeList
GetModuleFileNameW
SuspendThread
GetSystemDirectoryW
WriteFile
CreateWaitableTimerW
GetCurrentProcess
SetPriorityClass
HeapFree
SetWaitableTimer
GetProcessShutdownParameters
SetConsoleCtrlHandler
RaiseException
LeaveCriticalSection
GetStdHandle
EnterCriticalSection
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
GenerateConsoleCtrlEvent
GetCurrentProcessId
CreateEventW
WaitForMultipleObjects
QueryPerformanceCounter
QueryPerformanceFrequency
SetEvent
SetThreadPriority
CreateSemaphoreW
CloseHandle
GetLastError
GetCurrentThreadId
WaitForSingleObject
GetTempPathW
ReleaseSemaphore
GetProcAddress
Sleep
GetProcessAffinityMask

user32

GetWindowThreadProcessId
SendMessageW
DestroyWindow
DefWindowProcW
PostQuitMessage
GetSystemMetrics
LoadCursorW
LoadIconW
TranslateMessage
RegisterClassW
UnregisterPowerSettingNotification
DispatchMessageW
ShowWindow
UpdateWindow
RegisterPowerSettingNotification
PostMessageW
GetMessageW
GetWindowLongPtrW
CreateWindowExW
SetWindowLongPtrW

gdi32

GetStockObject

advapi32

RegFlushKey
RegSetValueExW
RegGetValueW
ConvertSidToStringSidW
GetTokenInformation
SetSecurityDescriptorDacl
RegCloseKey
CryptAcquireContextW
EqualSid
CloseServiceHandle
CryptGenRandom
OpenSCManagerW
RegDeleteKeyW
AllocateAndInitializeSid
SetEntriesInAclW
RegCreateKeyExW
OpenProcessToken
FreeSid
InitializeSecurityDescriptor
RegOpenKeyExW
QueryServiceConfigW
OpenServiceW
RegQueryValueExW
CryptReleaseContext
ReportEventW

shell32

SHGetKnownFolderPath

ole32

CoInitializeSecurity
CoCreateInstance
CoTaskMemFree
CoInitializeEx
CoUninitialize

oleaut32

VariantClear
SysAllocString
SysFreeString

libcrypto-3-x64

EVP_MD_CTX_new
EVP_DigestFinal_ex
EVP_MD_get_size
HMAC
EVP_DigestInit_ex
EVP_MD_CTX_free
EVP_DigestUpdate
EVP_md5
EVP_sha256

ws2_32

getpeername
WSAStartup
setsockopt
WSAGetLastError
connect
socket
send
accept
freeaddrinfo
getsockname
htons
ntohs
WSACleanup
ioctlsocket
shutdown
__WSAFDIsSet
bind
closesocket
listen
select
recv
getaddrinfo

iphlpapi

GetTcpTable2
GetIpAddrTable

rpcrt4

UuidCreate
RpcStringFreeW
UuidToStringW

shlwapi

StrToInt64ExW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec

bcrypt

BCryptGenRandom

dbghelp

SymInitialize
SymGetLineFromAddr64
MiniDumpWriteDump
SymFromAddr

pdh

PdhMakeCounterPathW
PdhOpenQueryW
PdhEnumObjectsW
PdhRemoveCounter
PdhCollectQueryData
PdhGetFormattedCounterValue
PdhEnumObjectItemsW
PdhGetRawCounterValue
PdhCalculateCounterFromRawValue
PdhLookupPerfNameByIndexW
PdhCloseQuery
PdhAddCounterW

userenv

ExpandEnvironmentStringsForUserW

ntdll

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
NtQueryInformationProcess

crypt32

CryptMsgClose
CryptQueryObject
CertCloseStore
CryptMsgGetParam
CryptDecodeObject

wintrust

WinVerifyTrust

vcruntime140

memset
__current_exception_context
__current_exception
memcmp
memcpy
memmove
wcsstr
strstr

api-ms-win-crt-string-l1-1-0

isdigit
wcsncmp
strncmp
_strdup
towupper
wmemmove_s
wcsncat_s
wcsncpy_s
wcsnlen
strtok_s
strncpy_s
wcstok_s
wcscat_s
strnlen
isprint
toupper
strncat_s

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_initterm
_set_app_type
_seh_filter_exe
_set_invalid_parameter_handler
_wassert
__p___argv
_invalid_parameter_noinfo
_cexit
_errno
_c_exit
__p___argc
_exit
_register_thread_local_exe_atexit_callback
_beginthreadex
terminate
_initterm_e
_initialize_onexit_table
_crt_atexit
_register_onexit_function
_endthread
exit

api-ms-win-crt-stdio-l1-1-0

fwrite
__stdio_common_vfprintf
__stdio_common_vsprintf_s
__p__commode
fclose
fflush
__stdio_common_vsscanf
fread
feof
__acrt_iob_func
_set_fmode
fopen
__stdio_common_vsnprintf_s
__stdio_common_vsnwprintf_s
fread_s
__stdio_common_vfwprintf
__stdio_common_vswprintf_s

api-ms-win-crt-heap-l1-1-0

realloc
_set_new_mode
free
malloc

api-ms-win-crt-time-l1-1-0

_time64
_ftime64_s
_gmtime64
_ctime64_s

api-ms-win-crt-filesystem-l1-1-0

_stat64
_access
_unlink
_access_s

api-ms-win-crt-convert-l1-1-0

_itoa_s
atoi
wcstombs
wcstombs_s
_itow_s
mbstowcs
_atoi64
_ui64toa_s
mbstowcs_s
atof
_strtoui64

api-ms-win-crt-utility-l1-1-0

srand
qsort_s
rand

api-ms-win-crt-math-l1-1-0

sin
sqrt
__setusermatherr
tan
cos
pow
log

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

__esrv_depend_on_service_start__
__esrv_esrv_version_major__
__esrv_esrv_version_minor__
__esrv_esrv_version_revision__
__esrv_esrv_version_update__
__esrv_respond_to_power_setting_notifications__
__esrv_socket_ipc__
__esrv_use_dynamic_errors__
__esrv_use_dynamic_watchdog__
__esrv_use_error_stack__
__esrv_use_idctl_thread_pool__
__esrv_use_rdctl_thread_pool__
__esrv_use_uniform_build_versioning__
__esrv_watchdog__
get_environment_variable
get_environment_variable_a
get_environment_variable_w
get_module_file_name
get_module_file_name_a
get_module_file_name_w
intel_modeler_customer_lc_name
intel_modeler_customer_uc_name
intel_modeler_release
intel_modeler_win32
intel_modeler_win64
p_exception_esrv
set_current_directory
set_current_directory_a
set_current_directory_w
sh_get_known_folder_path

Sections

.text
Size: 652KB - Virtual size: 651KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 319KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

714509d39dd11972911c7cc41426408a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

libcrypto-3-x64

ws2_32

iphlpapi

rpcrt4

shlwapi

version

api-ms-win-core-path-l1-1-0

bcrypt

dbghelp

pdh

userenv

ntdll

crypt32

wintrust

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 652KB - Virtual size: 651KB

.rdata Size: 51KB - Virtual size: 50KB

.data Size: 319KB - Virtual size: 1.0MB

.pdata Size: 11KB - Virtual size: 10KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 652KB - Virtual size: 651KB

.rdata
Size: 51KB - Virtual size: 50KB

.data
Size: 319KB - Virtual size: 1.0MB

.pdata
Size: 11KB - Virtual size: 10KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 568KB - Virtual size: 572KB