NEAS[.]1a2e3b6697f5468b0d4fd47e340d3e90_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.1a2e3b6697f5468b0d4fd47e340d3e90_JC.exe
Size

501KB
MD5

1a2e3b6697f5468b0d4fd47e340d3e90
SHA1

49718f6bbce178cbf16adb76d83d9af771632968
SHA256

163ddf6ac633b08d5a3b26c8ad0a3012ef5bdea113905165c7c28e6da41f6819
SHA512

3c2d4fbd18bb8a62694a9b8022b076bf0da45e8bd34270fb52461acce7ca68b66ed4e6b621a0788e4e8fc18f1dc7cbd67fb0dffab037f610ea5fc3895f00747c
SSDEEP

12288:jKk3Fr6Rl82LNJ3P7RMYEczR/v3I96xtYFOdxEiJRqFd1:Ovf82L/1fEwL/JRud

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.1a2e3b6697f5468b0d4fd47e340d3e90_JC.exe

Files

NEAS.1a2e3b6697f5468b0d4fd47e340d3e90_JC.exe
.dll regsvr32 windows:10 windows x64

795f3f0068e68e47b669f559cf7f5165

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_XcptFilter
_amsg_exit
_callnewh
??0exception@@QEAA@AEBQEBD@Z
memcpy
__CxxFrameHandler3
_CxxThrowException
wcschr
wcsncmp
wcsncpy_s
vswprintf_s
_wcsdup
_wtoi
_initterm
??0exception@@QEAA@AEBQEBDH@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
mbstowcs
_wcsicmp
wcstombs
wcsstr
_unlock
__dllonexit
_onexit
malloc
_vsnwprintf
??1type_info@@UEAA@XZ
memset
memcmp
wcstok_s
strchr
??3@YAXPEAX@Z
__C_specific_handler
?terminate@@YAXXZ
??0exception@@QEAA@AEBV0@@Z
memmove
_lock
_purecall
??_V@YAXPEAX@Z
free
wcscmp

atl

ord20
ord23
ord16
ord21
ord15
ord58
ord30
ord32
ord17

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlNtStatusToDosError
NtOpenFile
NtDelayExecution
RtlIpv4StringToAddressW
RtlFreeUnicodeString
RtlStringFromGUID
WinSqmIncrementDWORD
WinSqmSetDWORD
RtlDeregisterWaitEx
RtlRegisterWait
VerSetConditionMask
RtlInitUnicodeString

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleFileNameW
GetProcAddress
LoadResource
FreeLibrary
GetModuleHandleW
GetModuleHandleExW
LoadLibraryExW
LockResource
FreeLibraryAndExitThread
LoadStringW
GetModuleFileNameA
SizeofResource

rpcrt4

CStdStubBuffer_Connect
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
IUnknown_AddRef_Proxy
CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerQueryInterface
IUnknown_Release_Proxy
CStdStubBuffer_CountRefs
NdrOleAllocate
NdrOleFree
IUnknown_QueryInterface_Proxy
CStdStubBuffer_AddRef
NdrDllGetClassObject
NdrDllCanUnloadNow
UuidCreate
CStdStubBuffer_Invoke
NdrCStdStubBuffer_Release
CStdStubBuffer_IsIIDSupported

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient20
ObjectStublessClient13
ObjectStublessClient18
ObjectStublessClient16
ObjectStublessClient19
ObjectStublessClient12
ObjectStublessClient14
ObjectStublessClient4
ObjectStublessClient8
ObjectStublessClient7
ObjectStublessClient17
ObjectStublessClient3
ObjectStublessClient15
ObjectStublessClient11
ObjectStublessClient5
ObjectStublessClient6
ObjectStublessClient9
ObjectStublessClient10

api-ms-win-core-synch-l1-2-0

WaitForSingleObject
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
CreateEventW
DeleteCriticalSection
LeaveCriticalSection
ResetEvent
OpenEventW
Sleep
SetEvent
EnterCriticalSection

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter

iphlpapi

ConvertLengthToIpv4Mask
ConvertIpv4MaskToLength
ConvertInterfaceGuidToLuid
ConvertInterfaceIndexToLuid
ConvertInterfaceLuidToGuid
ConvertInterfaceLuidToNameW
ConvertInterfaceLuidToIndex
GetAdaptersAddresses

api-ms-win-core-debug-l1-1-1

OutputDebugStringW

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
CreateThread
GetCurrentProcess
GetCurrentProcessId
TerminateProcess

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-heap-l1-2-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-registry-l1-1-0

RegEnumValueW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

api-ms-win-core-sysinfo-l1-2-1

GetComputerNameExW
GetSystemTimeAsFileTime
GetTickCount
GetSystemDirectoryW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-security-base-l1-2-0

CheckTokenMembership
AllocateAndInitializeSid
FreeSid

api-ms-win-core-heap-l2-1-0

GlobalFree
LocalFree
GlobalAlloc
LocalAlloc

api-ms-win-core-string-l2-1-0

CharPrevW
CharNextW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
FindResourceW

userenv

UnregisterGPNotification
RegisterGPNotification

api-ms-win-core-io-l1-1-1

GetOverlappedResult
DeviceIoControl

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

gdi32

ExtTextOutW
GetTextMetricsW
SetBkColor
DeleteObject
GetTextExtentPoint32W
SetTextColor
GetTextExtentPointW
SelectObject

user32

RemovePropW
ShowWindow
GetWindowRect
PostMessageW
EnableWindow
SetWindowPos
WinHelpW
GetWindowLongW
SetWindowLongW
SetWindowsHookExW
GetDlgItemInt
IsDlgButtonChecked
SetDlgItemInt
MessageBoxW
MapWindowPoints
SetWindowTextW
UnhookWindowsHookEx
GetSystemMetrics
SetDlgItemTextW
CheckDlgButton
SetFocus
GetParent
GetWindowTextLengthW
GetWindowTextW
DialogBoxParamW
SendMessageW
GetDlgCtrlID
GetPropW
CallWindowProcW
GetWindowLongPtrW
LoadIconW
GetDlgItem
ReleaseDC
GetSysColor
BeginDeferWindowPos
GetDC
SetWindowLongPtrW
GetClientRect
EndDialog
DeferWindowPos
EndDeferWindowPos
SetPropW
IsWindowEnabled

nsi

NsiSetAllParameters
NsiGetAllParametersEx

winnsi

NsiRpcSetAllParameters

gpapi

ord107

netsetupapi

NetSetupFreeObjects
NetSetupGetObjectProperties
NetSetupFreeObjectProperties
NetSetupDeleteObject
NetSetupCommit
NetSetupGetObjects
NetSetupInitialize
NetSetupClose
NetSetupSetObjectProperties
NetSetupCreateObject

api-ms-win-core-privateprofile-l1-1-1

GetPrivateProfileStringW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpA
lstrlenW
lstrcmpiW
lstrcmpW
lstrlenA

api-ms-win-core-atoms-l1-1-0

GlobalDeleteAtom
GlobalAddAtomW

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW
RegisterWaitForSingleObject

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx
QueueUserWorkItem

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
HNetDeleteRasConnection
HNetFreeSharingServicesPage
HNetGetFirewallSettingsPage
HNetGetSharingServicesPage
HNetSharedAccessSettingsDlg
HNetSharingAndFirewallSettingsDlg
RegisterClassObjects
ReleaseSingletons
RevokeClassObjects
WinBomConfigureWindowsFirewall

Sections

.text
Size: 297KB - Virtual size: 297KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 143KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

795f3f0068e68e47b669f559cf7f5165

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

atl

ntdll

api-ms-win-core-libraryloader-l1-2-0

rpcrt4

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

iphlpapi

api-ms-win-core-debug-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-localization-l1-2-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-libraryloader-l1-2-1

userenv

api-ms-win-core-io-l1-1-1

api-ms-win-core-profile-l1-1-0

gdi32

user32

nsi

winnsi

gpapi

netsetupapi

api-ms-win-core-privateprofile-l1-1-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-atoms-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 297KB - Virtual size: 297KB

.rdata Size: 143KB - Virtual size: 143KB

.data Size: 4KB - Virtual size: 6KB

.pdata Size: 16KB - Virtual size: 16KB

.didat Size: 1024B - Virtual size: 832B

.rsrc Size: 31KB - Virtual size: 31KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 297KB - Virtual size: 297KB

.rdata
Size: 143KB - Virtual size: 143KB

.data
Size: 4KB - Virtual size: 6KB

.pdata
Size: 16KB - Virtual size: 16KB

.didat
Size: 1024B - Virtual size: 832B

.rsrc
Size: 31KB - Virtual size: 31KB

.reloc
Size: 6KB - Virtual size: 5KB