NEAS[.]f2d8964f376d570fde9298729b5d7b00_JC[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.f2d8964f376d570fde9298729b5d7b00_JC.exe
Size

928KB
MD5

f2d8964f376d570fde9298729b5d7b00
SHA1

dd1804c97669373cb3d6560cb7b43572f0da8535
SHA256

2fa128db34cb52edc7793a8cba9e3248900f43de0d8ebd40a7638d2a789ab6aa
SHA512

5aac546a7d75830c21cf7966eea7474cabd84565bcdbe887ba22d34232b2957c136d0c3cc34d054d01ee7280cb37eede0ca210742130b298b94edbdd1913acef
SSDEEP

12288:XiDLR4Jg4lNdNVKX8QoLICITPDq8j8fpkVxR4YQ0EFKMSx:SJ4Jg4lNdPKX8QsITPDq88BmROvFKv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.f2d8964f376d570fde9298729b5d7b00_JC.exe

Files

NEAS.f2d8964f376d570fde9298729b5d7b00_JC.exe
.exe windows:4 windows x86

2ffad7b252f0d6295fe2595882913a0c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadFile
GetModuleFileNameW
CreateProcessW
WaitForSingleObject
GetSystemDirectoryW
CloseHandle
LoadLibraryW
GetProcAddress
FindResourceW
GetCurrentProcessId
SizeofResource
LockResource
LoadResource
GetTempPathW
CreateFileW
FindResourceExW
GetCurrentProcess
GetFileSize
TerminateProcess
FindFirstFileW
lstrcmpW
SetFileAttributesW
DeleteFileW
MoveFileExW
MultiByteToWideChar
WideCharToMultiByte
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
RemoveDirectoryW
VirtualAlloc
DeleteCriticalSection
SetEvent
InitializeCriticalSection
ReleaseSemaphore
ResetEvent
CreateSemaphoreW
CreateEventW
WriteFile
GetStdHandle
CopyFileW
MoveFileW
GetTempFileNameW
GetSystemInfo
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
SetFilePointer
FindClose
GetLastError
FindNextFileW
CreateDirectoryW
GetFileAttributesW
GetTickCount
VirtualFree
CreateFileA
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
LoadLibraryA
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
GetVersionExA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
InterlockedIncrement
InterlockedDecrement
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
GetCurrentThreadId
CreateThread
GetStartupInfoW
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
ExitProcess
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
HeapCreate
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA

user32

CharLowerW
CharUpperW
UnregisterClassA

ole32

CoUninitialize
CoInitialize

oleaut32

SysFreeString
SysAllocString
VariantClear
VariantCopy

shlwapi

PathAddBackslashW

Sections

.text
Size: 232KB - Virtual size: 230KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 280KB - Virtual size: 279KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2ffad7b252f0d6295fe2595882913a0c

Headers

File Characteristics

Imports

kernel32

user32

ole32

oleaut32

shlwapi

Sections

.text Size: 232KB - Virtual size: 230KB

.rdata Size: 48KB - Virtual size: 46KB

.data Size: 12KB - Virtual size: 27KB

.rsrc Size: 280KB - Virtual size: 279KB

.text
Size: 232KB - Virtual size: 230KB

.rdata
Size: 48KB - Virtual size: 46KB

.data
Size: 12KB - Virtual size: 27KB

.rsrc
Size: 280KB - Virtual size: 279KB