skarsnik
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.0469c8a8ff7d105320124c5a4161bb00_JC.dll
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.0469c8a8ff7d105320124c5a4161bb00_JC.dll
Resource
win10v2004-20231025-en
General
-
Target
NEAS.0469c8a8ff7d105320124c5a4161bb00_JC.exe
-
Size
1.2MB
-
MD5
0469c8a8ff7d105320124c5a4161bb00
-
SHA1
8ba5b68cbe9d3d7140bb5e23e56fce4a20fce1f8
-
SHA256
c038d95d78986d710559fb82f96dc2f61554a96c0307c14d47a059ee7bbb1e23
-
SHA512
63543d3ba502c1853c8d2012b9929e50c2cf173bc880c904bb233c6f7054098cbe641c8f9fa0badfaac09af8455a5582bdf0904d068e0fdfcef706ca07b445e9
-
SSDEEP
24576:2fNu066GNICwvY3YfAQbEsKGMvasniXbFILKTas+7tM:2fn66gkYofAnNPiryLKT7+7tM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.0469c8a8ff7d105320124c5a4161bb00_JC.exe
Files
-
NEAS.0469c8a8ff7d105320124c5a4161bb00_JC.exe.dll windows:5 windows x86
26b75ae0cea6f6ab18b410ad4584678c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ws2_32
WSAStartup
getsockopt
WSACleanup
ntohl
ntohs
htonl
htons
closesocket
connect
freeaddrinfo
getaddrinfo
WSAGetLastError
setsockopt
WSASocketW
WSASend
WSARecv
select
ioctlsocket
WSASetLastError
kernel32
SetEnvironmentVariableA
SetEndOfFile
GetTimeZoneInformation
LoadLibraryW
Sleep
FreeLibraryAndExitThread
GetProcAddress
GetCurrentThreadId
CreateThread
GetModuleHandleExW
GetModuleFileNameW
GetNativeSystemInfo
IsWow64Process
GetLastError
CloseHandle
GetCurrentProcess
GetModuleHandleW
GetVersionExW
GetExitCodeThread
WaitForSingleObject
TerminateThread
OpenEventW
CreateEventW
SetEvent
ResetEvent
GetSystemTimeAsFileTime
CreateEventA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TlsAlloc
InterlockedIncrement
InterlockedExchange
InterlockedDecrement
InterlockedExchangeAdd
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjects
QueueUserAPC
SleepEx
PostQueuedCompletionStatus
CreateIoCompletionPort
SetWaitableTimer
GetQueuedCompletionStatus
InterlockedCompareExchange
SetLastError
TlsGetValue
TlsSetValue
TlsFree
HeapReAlloc
HeapAlloc
HeapFree
RaiseException
DecodePointer
FormatMessageA
OpenEventA
CreateFileW
FreeLibrary
InitializeSListHead
GetModuleHandleA
GetThreadTimes
OutputDebugStringW
WriteConsoleW
SetStdHandle
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EncodePointer
IsProcessorFeaturePresent
GetCommandLineA
FileTimeToSystemTime
GetCPInfo
ExitThread
LoadLibraryExW
IsDebuggerPresent
ExitProcess
AreFileApisANSI
FileTimeToLocalFileTime
GetFileInformationByHandle
GetFileType
PeekNamedPipe
ReadFile
GetConsoleMode
ReadConsoleW
SetFilePointerEx
WriteFile
GetConsoleCP
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapSize
GetProcessHeap
GetCurrentThread
IsValidCodePage
GetACP
GetOEMCP
GetStdHandle
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
user32
EnumWindows
GetClassNameW
SendMessageTimeoutW
advapi32
RegCloseKey
RegOpenKeyExW
Exports
Exports
Sections
.text Size: 871KB - Virtual size: 871KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 225KB - Virtual size: 225KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 50KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 51KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ