NEAS[.]d9b06cba3d7a6c12c8dc473225a49ab0_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.d9b06cba3d7a6c12c8dc473225a49ab0_JC.exe
Size

308KB
MD5

d9b06cba3d7a6c12c8dc473225a49ab0
SHA1

20abcc1d04808f0530789ebda55103bf0b89c38c
SHA256

57b1ba15fb74bf64ce06f0b94f178d806da9d12276824421d786f79cbb59fec2
SHA512

226f9d1fb2fd74189d2a6c4d437652d8ebaafc54075188d87699547a95327552c45d0e50322edcd48c96209adf8e71d638ea12276570339cda3473991f849b2c
SSDEEP

6144:ehvXOTqMgOUf6nUnmJYe0HOSjcpV+XajKqlp57R:e9sq956nUmSe0H9oeajKEl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.d9b06cba3d7a6c12c8dc473225a49ab0_JC.exe

Files

NEAS.d9b06cba3d7a6c12c8dc473225a49ab0_JC.exe
.dll windows:6 windows x64

d7e4e6cd747780b1f688eef32e104267

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

memset
__C_specific_handler
_amsg_exit
free
_initterm
_XcptFilter
swprintf_s
_snwprintf_s
wcschr
strncmp
towupper
wcsrchr
memmove
wcsncpy_s
strcpy_s
memcpy
memcmp
malloc
wcscpy_s
wcsncmp
wcscat_s
wcsncat_s
_vsnprintf_s
sprintf_s
_wcsicmp
_ultow

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
EtwEventWrite
EtwEventUnregister
EtwEventRegister
EtwEventEnabled
RtlTimeToTimeFields
RtlEqualString
RtlInsertElementGenericTable
RtlInitializeGenericTable
NtOpenProcess
NtDuplicateToken
RtlLeaveCriticalSection
RtlIpv6StringToAddressExW
RtlLookupElementGenericTable
NtQueryInformationProcess
RtlDeleteElementGenericTable
RtlEnterCriticalSection
RtlGetElementGenericTable
RtlNumberGenericTableElements
RtlCreateSecurityDescriptor
NtDuplicateObject
NtSetSecurityObject
NtQueryInformationToken
NtOpenProcessToken
RtlAddAccessAllowedAce
RtlSetDaclSecurityDescriptor
RtlCreateAcl
RtlNtStatusToDosError
RtlOemStringToUnicodeString
RtlUpcaseUnicodeStringToOemString
RtlInitializeCriticalSection
RtlFreeOemString
WinSqmSetDWORD
NtQuerySystemInformation
NtOpenKey
EtwGetTraceLoggerHandle
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
RtlIntegerToChar
NtSetValueKey
NtQueryValueKey
RtlAppendUnicodeStringToString
RtlDeleteResource
NtCreateKey
RtlAppendUnicodeToString
NtDeleteValueKey
RtlIntegerToUnicodeString
RtlEqualSid
RtlGetNtProductType
NtAllocateLocallyUniqueId
RtlCopyUnicodeString
NtCreateEvent
NtOpenEvent
RtlPrefixUnicodeString
RtlConvertSharedToExclusive
NtWaitForSingleObject
RtlAcquireResourceExclusive
RtlCopySid
RtlUpcaseUnicodeString
RtlInitializeResource
RtlLengthSid
RtlSubAuthorityCountSid
RtlCompareMemory
RtlInitializeSid
RtlUpperChar
EtwLogTraceEvent
RtlDowncaseUnicodeString
NtQuerySystemTime
RtlIdentifierAuthoritySid
WinSqmIncrementDWORD
RtlLengthRequiredSid
RtlSubAuthoritySid
RtlAcquireResourceShared
NtFilterToken
RtlAllocateAndInitializeSid
RtlDuplicateUnicodeString
RtlReleaseResource
NtClose
RtlImpersonateSelf
NtSetInformationThread
RtlFreeUnicodeString
RtlEqualDomainName
RtlEqualUnicodeString
NtOpenThreadToken
RtlFreeSid
RtlRunDecodeUnicodeString
RtlEraseUnicodeString
EtwTraceMessage
RtlFreeHeap
RtlAllocateHeap
RtlImageNtHeader
NtSetEvent
RtlInitString
RtlInitUnicodeString
RtlSystemTimeToLocalTime

api-ms-win-security-base-l1-1-0

AllocateAndInitializeSid
RevertToSelf
FreeSid
CheckTokenMembership
ImpersonateAnonymousToken
GetTokenInformation
AdjustTokenPrivileges
EqualSid
GetLengthSid

cryptdll

CDLocateCheckSum
aesCTSDecryptMsg
aesCTSEncryptMsg
HMACwithSHA
PBKDF2

kernel32

GetCurrentThread
WriteFile
LoadLibraryW
CreateFileW
FlushFileBuffers
FreeLibrary
GetProcAddress
GetLocalTime
CloseHandle
GetWindowsDirectoryW
GetComputerNameW
LoadLibraryA
UnregisterWait
GetProfileIntW
RegisterWaitForSingleObjectEx
GetModuleHandleW
GetModuleFileNameW
GetCurrentThreadId
SetFilePointer
GetLastError
GetCurrentProcessId
GetVersionExW
GetComputerNameExW
DisableThreadLibraryCalls
CreateEventW
ExpandEnvironmentStringsW
SetLastError
GetSystemInfo
RegSetValueExW
DeleteTimerQueueTimer
OpenFileMappingW
SetCurrentDirectoryW
CreateFileMappingW
CreateTimerQueueTimer
ChangeTimerQueueTimer
GetCurrentDirectoryW
GetSystemDirectoryW
CreateDirectoryW
MoveFileExW
MapViewOfFileEx
UnmapViewOfFile
SetThreadStackGuarantee
VirtualProtect
VirtualAlloc
VirtualQuery
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
QueryPerformanceCounter
Sleep
DelayLoadFailureHook
LoadLibraryExA
OpenProcess
QueryFullProcessImageNameW
FormatMessageW
DebugBreak
IsDebuggerPresent
FormatMessageA
GetTickCount
LocalFree
LocalAlloc

Exports

Exports

DllMain
LsaApCallPackage
LsaApCallPackagePassthrough
LsaApCallPackageUntrusted
LsaApInitializePackage
LsaApLogonTerminated
LsaApLogonUserEx2
Msv1_0ExportSubAuthenticationRoutine
Msv1_0SubAuthenticationPresent
MsvGetLogonAttemptCount
MsvIsLocalhostAliases
MsvSamLogoff
MsvSamValidate
MsvValidateTarget
SpInitialize
SpInstanceInit
SpLsaModeInitialize
SpUserModeInitialize

Sections

.text
Size: 249KB - Virtual size: 248KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d7e4e6cd747780b1f688eef32e104267

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

api-ms-win-security-base-l1-1-0

cryptdll

kernel32

Exports

Exports

Sections

.text Size: 249KB - Virtual size: 248KB

.rdata Size: 25KB - Virtual size: 25KB

.data Size: 17KB - Virtual size: 17KB

.pdata Size: 9KB - Virtual size: 8KB

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 512B - Virtual size: 352B

.text
Size: 249KB - Virtual size: 248KB

.rdata
Size: 25KB - Virtual size: 25KB

.data
Size: 17KB - Virtual size: 17KB

.pdata
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 512B - Virtual size: 352B