NEAS[.]ff6cd3ff2b3f01468b83e5de5ec1c950_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.ff6cd3ff2b3f01468b83e5de5ec1c950_JC.exe
Size

152KB
MD5

ff6cd3ff2b3f01468b83e5de5ec1c950
SHA1

eac13133c2b53d35935b95d0eeb67c047bdff848
SHA256

fd1dd07ec1f5bc094ceccd37b82665d1d0bacd47f3b513157abb534414a24f99
SHA512

12fed1386db1b7066ae9f55f19e3a1555c6c8b70f9a01d90898a9dc59305c2f17fbbae26bef3f321973d7066abf36af592fd94bf24ed00fa8db9c95ad329caa8
SSDEEP

3072:2DrowA3igfBag43kRRpkow/4o6hPAoi6NSgBTlrE4txh6:2vjo8wSWTl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.ff6cd3ff2b3f01468b83e5de5ec1c950_JC.exe

Files

NEAS.ff6cd3ff2b3f01468b83e5de5ec1c950_JC.exe
.exe windows:4 windows x86

24419e5073cae9f64ba42cbc05d020dd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

ord690
ord588
MethCallEngine
ord518
ord593
ord300
ord594
ord301
ord595
ord596
ord303
ord306
ord520
ord307
ord309
ord631
ord526
EVENT_SINK_AddRef
DllFunctionCall
ord670
EVENT_SINK_Release
ord600
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord716
ProcCallEngine
ord535
ord536
ord537
ord645
ord572
ord681
ord576
ord685
ord100
ord689
ord616
ord619
ord581

Sections

.text
Size: 120KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ