NEAS[.]cd617d7fa4a2bcd7f851cf2e7e1aded0_JC[.]exe | Triage

Sharing

General

Target

NEAS.cd617d7fa4a2bcd7f851cf2e7e1aded0_JC.exe
Size

10KB
MD5

cd617d7fa4a2bcd7f851cf2e7e1aded0
SHA1

cd268c9e286eb623f8e03ae2838e9c5857692b0e
SHA256

ac047bd7a4bee252afe6b81b92ae30107c6c333d19c9aebedd27a99d56e3a36d
SHA512

b0739b47aa1b557df0c35cc40bfe00977e14790cbadd2dea55a9616fa4f5e35990a186f2221e97677943a7d353b64379dbb17bae3acc9cadde52b7655447d8e5
SSDEEP

192:Deiw/CaYUbl3juxeFu4L18ks+IkHtK/d3w:D3w6au5U8iIkHIVA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.cd617d7fa4a2bcd7f851cf2e7e1aded0_JC.exe

Files

NEAS.cd617d7fa4a2bcd7f851cf2e7e1aded0_JC.exe
.dll windows:4 windows x86

c5ef05c1e3ccf383252ff2d5ef4dad2f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

KeWaitForSingleObject
RtlFreeUnicodeString
IoCreateDevice
RtlAppendUnicodeStringToString
RtlInitUnicodeString
ExAllocatePoolWithTag
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwQueryValueKey
ZwClose
ZwOpenKey
RtlCompareUnicodeString
ExFreePool
IofCallDriver
IoBuildSynchronousFsdRequest
KeInitializeEvent
IoDeleteDevice
IoAttachDeviceToDeviceStack
InterlockedIncrement
InterlockedDecrement
KeSetEvent
IofCompleteRequest
IoDetachDevice

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 752B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 380B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ