NEAS[.]119560937a0c111f017812480d464990_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.119560937a0c111f017812480d464990_JC.exe
Size

1.5MB
MD5

119560937a0c111f017812480d464990
SHA1

c512013f9efe77462902ed77a0c8dee243297ea4
SHA256

e70686be68cf63ebb766e2961cb728ffc6b285a981380420d306751072805b50
SHA512

a1d7e27f084c88274dfcd0cd198f7db34de6a0cc721a3e1c37116bc2706365e97fd5c83360685065f2ebeb03163fd30ba96b902cb1a679bfd72a8bbb45e9810c
SSDEEP

49152:NdyVxkcHjX0VIDX/G080qrrESRH2T+Qvfy/4JcaZZ07xCP/Bej:TyVxkcHjX0Q4rEq2T+QvA4Jc6Z0VChS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.119560937a0c111f017812480d464990_JC.exe

Files

NEAS.119560937a0c111f017812480d464990_JC.exe
.exe windows:5 windows x86

47952387d64834b5a192a77f583bb437

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

msvcrt

strncpy

iphlpapi

GetInterfaceInfo

psapi

GetMappedFileNameW

kernel32

GetModuleFileNameW

user32

IsWindowVisible

advapi32

RegQueryValueExA

shell32

SHGetFolderPathW

Sections

.text
Size: 696KB - Virtual size: 696KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 869KB - Virtual size: 872KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ