NEAS[.]efb3b0105a4ccaf5a38cd48b675f9650_JC[.]exe

General

Target

NEAS.efb3b0105a4ccaf5a38cd48b675f9650_JC.exe
Size

40KB
MD5

efb3b0105a4ccaf5a38cd48b675f9650
SHA1

791d7ac35b0051e388385c763fa5b6c35a140232
SHA256

4c0d4ec822fdd1d18c66fdcb9b73294c73126feb6bd3837d4dfd4c614f3a3a41
SHA512

28111d8336c99c02eacd122fe0f66adef1f78f3dd80cb64f391535843cc89706add4cad21a6b54f2cf91ebe32adbaf9ca05c4f9db687c662d6d7bb4ec786fce1
SSDEEP

768:VFLk7Ow8tWmef8vxCIsat2S5uw8R55ZiF/osQ:XktmeNPat2S5losQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.efb3b0105a4ccaf5a38cd48b675f9650_JC.exe

Files

NEAS.efb3b0105a4ccaf5a38cd48b675f9650_JC.exe
.exe windows:4 windows x86

76a8bfe690ed91e85bf55d8f7dd7e0d5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
CreateEventA
WaitForSingleObject
CloseHandle
SetEvent
SuspendThread
ResumeThread
CreateThread
Sleep
GetCurrentDirectoryA
ExitProcess
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
IsBadCodePtr
GetCommandLineA
GetVersion
RtlUnwind
WriteFile
ReadFile
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
HeapFree
FlushFileBuffers
HeapAlloc
HeapReAlloc
HeapSize
SetStdHandle
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
IsBadWritePtr
GetProcAddress
LoadLibraryA
SetUnhandledExceptionFilter
IsBadReadPtr

advapi32

OpenServiceA
DeleteService
OpenSCManagerA
CreateServiceA
CloseServiceHandle
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceCtrlDispatcherA

stabilitylib

fnLIB_PerfMonInit
fnLIB_GetCPUUsage
fnLIB_PerfMonUninit

ock

SetRatio_SDE

Sections

.text
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

76a8bfe690ed91e85bf55d8f7dd7e0d5

Headers

File Characteristics

Imports

kernel32

advapi32

stabilitylib

ock

Sections

.text Size: 28KB - Virtual size: 24KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 7KB

.text
Size: 28KB - Virtual size: 24KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 7KB