NEAS[.]550f985f0fd5ccc2dd3670bc74730820_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.550f985f0fd5ccc2dd3670bc74730820_JC.exe
Size

143KB
MD5

550f985f0fd5ccc2dd3670bc74730820
SHA1

e4fd42039c236c6025533b735a30bd7d84ba0cc3
SHA256

66f6d520b47485f2235eff68a23372a2db72d390ae7b5ba5e25c23be479627ef
SHA512

433354d482ef6227b8b6a215d85ae19bddc1f22b15befc2a1256d223c5c1dc336c5b59447d883a7e4ad2e2578b3e2659324d6d474d16f300784cad428930d17d
SSDEEP

3072:GWMIJWZY1gTz6Anp7+s7q5s81+1zJFpriSrY1k:wogqAnZJ25VOpe0Yi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.550f985f0fd5ccc2dd3670bc74730820_JC.exe

Files

NEAS.550f985f0fd5ccc2dd3670bc74730820_JC.exe
.exe windows:1 windows x86

d82ceab8013612dc27ff5d9983c81aac

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CryptBinaryToStringA

kernel32

GetLastError
GetProcAddress
LoadLibraryA
RtlUnwind
VirtualProtect
SetLastError
GetModuleHandleA
lstrcpyA
lstrcmpA
lstrcatA
lstrcmpiA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime

shlwapi

PathAppendA

crtdll

__GetMainArgs
exit
raise
signal

framedyn

?ReleaseBuffer@CHString@@QAEXH@Z

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 40B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc2
Size: 200B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE