Static task
static1
Behavioral task
behavioral1
Sample
NEAS.df787091ae37c52022969d4acc355aa0_JC.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.df787091ae37c52022969d4acc355aa0_JC.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.df787091ae37c52022969d4acc355aa0_JC.exe
-
Size
170KB
-
MD5
df787091ae37c52022969d4acc355aa0
-
SHA1
89fe92435154c350797b5afcbfa7ebc5c432fc2a
-
SHA256
ebafb85570b28f9f0855a02f3631d053b8be51583425cb18df3b66a09e3d3c8c
-
SHA512
93a57fa5ce75dea3c7590111bb04b0d7aa4f9df115201c8e13a81ad9970d868e52985df086bb24d6c1061f710aa521adaa81a36771e5ecc84d711732129a2845
-
SSDEEP
1536:s9SsmEuUQ0/Siir+jJuCGEvkznmP+upxEJcoLN4LZ8BSaPXDe8:uT/NbGEv8mWupxEKoBuiB/XDl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.df787091ae37c52022969d4acc355aa0_JC.exe
Files
-
NEAS.df787091ae37c52022969d4acc355aa0_JC.exe.exe windows:4 windows x86
b52f1898b4b003f762f5b9c03e005e8a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
wsprintfA
MessageBoxA
GetClassNameA
IsWindowVisible
GetAsyncKeyState
GetWindow
GetWindowThreadProcessId
kernel32
ReadFile
LCMapStringA
LoadLibraryA
FreeLibrary
Sleep
GetLocalTime
GetStartupInfoA
CreateProcessA
OpenProcess
GetModuleHandleA
GetProcAddress
ReadProcessMemory
CreateRemoteThread
VirtualFreeEx
CloseHandle
WaitForSingleObject
GetExitCodeThread
VirtualProtectEx
WriteProcessMemory
CreateToolhelp32Snapshot
Module32First
CreateThread
OpenEventA
CreateEventA
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
WriteFile
GetFileSize
CreateFileA
MoveFileA
DeleteFileA
msvcrt
malloc
_CIfmod
_CIpow
strchr
realloc
memmove
__CxxFrameHandler
sprintf
strncpy
atoi
??3@YAXPAX@Z
strncmp
??2@YAPAXI@Z
modf
_ftol
free
Sections
.text Size: 151KB - Virtual size: 151KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 672B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ