NEAS[.]f58d949b70357349a0e659af52fdddf0_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.f58d949b70357349a0e659af52fdddf0_JC.exe
Size

25KB
MD5

f58d949b70357349a0e659af52fdddf0
SHA1

687a662a47c0c7cd83f23e8bbd5f0d8e3d0e439d
SHA256

d28b4195045336a69ca3845311b4f21e1bc21fa015bf28a2b76e72423b5bc641
SHA512

f011f8937f8874b178fbb01a00358c49a626e901de264ba8b6dc6881f3b0cfccce815b53f91a056e54cce7e8e8dc9bedd2815d9ef5106066e44f719e1f920f9d
SSDEEP

384:T6NQNYwUOWjY/zc41xXLZvD35NEN1PTWCEIzyCy6wQbrmckC5bA4wxVIA:GQYe1zcSdLdJNELTWChtBbLwH1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.f58d949b70357349a0e659af52fdddf0_JC.exe

Files

NEAS.f58d949b70357349a0e659af52fdddf0_JC.exe
.dll windows:4 windows x86

c5ef05c1e3ccf383252ff2d5ef4dad2f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

KeWaitForSingleObject
RtlFreeUnicodeString
IoCreateDevice
RtlAppendUnicodeStringToString
RtlInitUnicodeString
ExAllocatePoolWithTag
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwQueryValueKey
ZwClose
ZwOpenKey
RtlCompareUnicodeString
ExFreePool
IofCallDriver
IoBuildSynchronousFsdRequest
KeInitializeEvent
IoDeleteDevice
IoAttachDeviceToDeviceStack
InterlockedIncrement
InterlockedDecrement
KeSetEvent
IofCompleteRequest
IoDetachDevice

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 616B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ