NEAS[.]27b379c11953a29cb0b9e9a628a76430_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.27b379c11953a29cb0b9e9a628a76430_JC.exe
Size

24KB
MD5

27b379c11953a29cb0b9e9a628a76430
SHA1

4dc6ef02239f76ea59a8e40ec226e41c2ab19a2d
SHA256

8dbfc482bcd77cb68bfd1139c1c12bac600bb40405c5f4100c670e9d518674e7
SHA512

e30fb778c0607bf40ece85a6f322b868639a5ce5ca518a077e3486435e61b835c89bbaae204dedc995e4610f90d98a1c91df41eba8bed20877f7933ce50a0af0
SSDEEP

384:YAk8pj0xZ2YVi9UVtOcsChMav9pyHkauZ/dVIBlfylAImKMBZ9cB/:Y6N0x/MA8ut9prHC6lAIdMPy9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.27b379c11953a29cb0b9e9a628a76430_JC.exe

Files

NEAS.27b379c11953a29cb0b9e9a628a76430_JC.exe
.exe windows:4 windows x64

b1736bac55e770870fe0087ac46e0c02

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

liblocal

_lginit
Win32OSPlatformId
fullpath2
eventprintf
inttostr
render_string
lg_sprintf
lg_wcs_to_utf8s
msg_lit_create
lg_utf8s_to_wcs

advapi32

ControlService
CloseServiceHandle
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
CreateServiceW
DeleteService
QueryServiceConfigW
EnumDependentServicesW
OpenServiceW
OpenSCManagerW
SetServiceStatus
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW
QueryServiceStatus
StartServiceW

user32

PostMessageW
GetMessageW
DispatchMessageW
LoadIconW
LoadCursorW
RegisterClassW
CreateWindowExW
DefWindowProcW
MessageBoxW

gdi32

GetStockObject

msvcr80

_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
_encode_pointer
__set_app_type
__crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
__initenv
_cexit
_exit
_XcptFilter
__C_specific_handler
__getmainargs
_amsg_exit
__lconv_init
exit
strstr
malloc
free

kernel32

SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
UnhandledExceptionFilter
SetThreadExecutionState
CreateMutexW
GetModuleHandleW
GetProcAddress
InitializeCriticalSection
CreateEventW
WaitForMultipleObjects
CreateThread
WaitForSingleObject
GetSystemTimeAsFileTime
GetSystemPowerStatus
OpenThread
EnterCriticalSection
LeaveCriticalSection
OpenProcess
TerminateProcess
GetLastError
Sleep
SetEvent
FormatMessageW
GetCurrentProcess
CloseHandle

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 564B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b1736bac55e770870fe0087ac46e0c02

Headers

DLL Characteristics

File Characteristics

Imports

liblocal

advapi32

user32

gdi32

msvcr80

kernel32

Sections

.text Size: 12KB - Virtual size: 12KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 28KB

.pdata Size: 1024B - Virtual size: 564B

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 12KB - Virtual size: 12KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 28KB

.pdata
Size: 1024B - Virtual size: 564B

.rsrc
Size: 1KB - Virtual size: 1KB