Static task
static1
Behavioral task
behavioral1
Sample
NEAS.0391b8cb4598e50b37ec7a2ab561cca0_JC.exe
Resource
win7-20231023-en
General
-
Target
NEAS.0391b8cb4598e50b37ec7a2ab561cca0_JC.exe
-
Size
1.0MB
-
MD5
0391b8cb4598e50b37ec7a2ab561cca0
-
SHA1
23ae5339535c62e57dcfc00a89f3fd0aa18e0880
-
SHA256
4c103d3a58fa4dc03e0041c0923547714760c37b30225039974987d16eb7d761
-
SHA512
81fe5a6561e1bde07ea205b0a2e2bdab2b9579a674faf24d383c02e57669a16948b260613997e94f4a4990c17709841fd0ce319629be2898f5f2b4bd77fc448b
-
SSDEEP
24576:xloDTKjWCpjTjQ7i25L0rqR5olTtzglTisvFLVsUkae:xCDejWCpTQe6otgVBFCae
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.0391b8cb4598e50b37ec7a2ab561cca0_JC.exe
Files
-
NEAS.0391b8cb4598e50b37ec7a2ab561cca0_JC.exe.exe windows:4 windows x86
a62565cb5049e1b8714e5ad4afeac5af
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindFirstFileA
FindNextFileW
FindNextFileA
FindClose
GetProcessTimes
GetPrivateProfileStringA
GetPrivateProfileIntA
CreateFileA
ReadFile
WriteFile
DeviceIoControl
SetLastError
GetCurrentDirectoryW
CompareStringW
CompareStringA
IsBadCodePtr
IsBadReadPtr
GetExitCodeProcess
CreatePipe
SetEnvironmentVariableA
SetEnvironmentVariableW
GetFullPathNameW
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
FlushFileBuffers
LCMapStringW
LCMapStringA
GetEnvironmentStringsW
CreateEventA
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetEndOfFile
GetStdHandle
SetHandleCount
SetStdHandle
FindFirstFileW
DeleteCriticalSection
InitializeCriticalSection
IsBadWritePtr
HeapCreate
HeapDestroy
GetModuleFileNameA
TlsGetValue
TlsAlloc
GetCurrentThreadId
GetCurrentProcessId
GetFullPathNameA
GetCurrentDirectoryA
PeekNamedPipe
GetFileInformationByHandle
DuplicateHandle
ExitThread
TlsSetValue
CreateThread
ResumeThread
DeleteFileW
DeleteFileA
GetFileAttributesW
ResetEvent
GetTickCount
CreateMutexA
WaitForSingleObject
FreeLibrary
ReleaseMutex
CloseHandle
SetHandleInformation
SetErrorMode
LoadLibraryA
GetEnvironmentVariableW
GetModuleHandleA
GetCommandLineW
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetProcAddress
ExitProcess
GetEnvironmentVariableA
GetShortPathNameA
FormatMessageA
LocalFree
Sleep
VirtualFree
VirtualAlloc
GetCurrentProcess
GetDriveTypeA
GetVolumeInformationA
HeapSize
SetEvent
MoveFileW
MoveFileA
GetDriveTypeW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLastError
CreateProcessA
GetVersion
GetWindowsDirectoryA
GetEnvironmentStrings
CreateFileW
HeapReAlloc
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
RtlUnwind
HeapAlloc
HeapFree
GetTimeZoneInformation
GetSystemTimeAsFileTime
GetLocalTime
GetSystemTime
GetFileAttributesA
SetFilePointer
GetFileType
RaiseException
GetStartupInfoA
GetCommandLineA
InterlockedDecrement
InterlockedIncrement
user32
GetDlgItem
CheckRadioButton
SetMenuItemInfoA
MessageBoxA
SendDlgItemMessageA
wsprintfA
ShowWindow
DialogBoxIndirectParamA
CreateDialogIndirectParamA
GetClientRect
GetFocus
GetParent
GetDlgItemTextA
GetDlgItemTextW
SetDlgItemTextA
GetSystemMetrics
GetActiveWindow
LoadBitmapA
SetWindowLongA
CallWindowProcA
GetWindowRect
ScreenToClient
MoveWindow
GetDC
ReleaseDC
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
IsDialogMessageA
IsWindowEnabled
SetForegroundWindow
InvalidateRect
DestroyWindow
PostMessageA
RedrawWindow
GetWindowLongA
EndDialog
CreateDialogParamA
EnableWindow
MessageBeep
GetWindowTextA
SetWindowTextA
SetFocus
SendMessageA
GetWindowTextLengthA
GetCursor
LoadCursorA
SetCursor
ShowCursor
netapi32
Netbios
advapi32
QueryServiceConfigA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
GetUserNameW
GetUserNameA
RegSetValueExW
RegQueryValueExW
RegEnumValueA
ControlService
StartServiceA
RegDeleteKeyA
RegDeleteValueA
DeleteService
OpenSCManagerA
CreateServiceA
CloseServiceHandle
OpenServiceA
ChangeServiceConfigA
RegEnumKeyExA
RegSetValueExA
gdi32
DeleteObject
SelectObject
GetTextMetricsA
GetStockObject
CreateFontIndirectA
comdlg32
GetSaveFileNameA
GetOpenFileNameA
shell32
ShellExecuteA
comctl32
ImageList_Add
ImageList_Create
ImageList_GetImageCount
ord17
wsock32
gethostname
send
htons
closesocket
Sections
.text Size: 716KB - Virtual size: 712KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 76KB - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_TEXT_HA Size: 68KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rmnet Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE