NEAS[.]32e73e577492945d1226e3e666be83d0_JC[.]exe | Triage

Sharing

General

Target

NEAS.32e73e577492945d1226e3e666be83d0_JC.exe
Size

119KB
MD5

32e73e577492945d1226e3e666be83d0
SHA1

1f543109556858664de3a507298679decf023b42
SHA256

9326c32b5f53a91a7487dd5c9fa3aafc8a513a9844235c6aa19edb2605e94402
SHA512

bca6d987b1cafaeb3b112b2c175d9d51cb4e55f9d87d4fc35190940392b532603668ef74cd2c7c9fcfec7b2c4e1a5a2cb55f9da82d6bbd46c8a41ccb1617c43b
SSDEEP

3072:5RjWhYDsCbmKxmOYjwMgEV0ne8wJRZLruld5KrhJ:5IGxmKxm/Pfke8wXNu5KT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.32e73e577492945d1226e3e666be83d0_JC.exe

Files

NEAS.32e73e577492945d1226e3e666be83d0_JC.exe
.exe windows:4 windows x86

a827d7265cecd803b4e2012fe0433502

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVolumeInformationA
CreateThreadpool
LocalCompact
GetPrivateProfileSectionNamesA
OpenEventW
SwitchToThread
GetCompressedFileSizeTransactedA
GetVolumePathNameW
SuspendThread
BindIoCompletionCallback

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE