NEAS[.]2177f05d6b7a6b36f49364af57bb4dc0_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.2177f05d6b7a6b36f49364af57bb4dc0_JC.exe
Size

478KB
MD5

2177f05d6b7a6b36f49364af57bb4dc0
SHA1

2a9e0f86870707e47507e1f2b4cbc389dd0e8623
SHA256

e044372128bb312469287220790a93c2104c54f7af7aa554d48cee35b16a7aad
SHA512

2d32a34825335df08b61e5d7e3dc522081eed5b6f2a7e27c485b0703bb446366ff8e5cd987fd772ec1395ab74d6863949abf80cc8642a848c549d178188c8fbd
SSDEEP

3072:vjuQOtOgZjs/dErXKK0S87Y1Lsgm/T+GECNXP2gHTZt+Tf:7P/d4aAIf8ChP2+v+Tf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.2177f05d6b7a6b36f49364af57bb4dc0_JC.exe

Files

NEAS.2177f05d6b7a6b36f49364af57bb4dc0_JC.exe
.dll regsvr32 windows:4 windows x86

3a39de2ddb539600bc503b32d411a8de

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegEnumKeyW
RegGetValueW
RegOpenKeyExW

kernel32

DisableThreadLibraryCalls
EnumResourceNamesW
FindResourceW
GetEnvironmentVariableW
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetTickCount
HeapAlloc
HeapFree
HeapReAlloc
InitOnceExecuteOnce
IsBadStringPtrW
LoadLibraryW
LoadResource
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
SizeofResource
WideCharToMultiByte
lstrcmpW

ntdll

_vsnprintf

ucrtbase

__acrt_iob_func
__stdio_common_vsprintf
__stdio_common_vswprintf
_strdup
_wcsdup
calloc
free
fwrite
getenv
malloc
memcmp
memcpy
memmove
realloc
strchr
strcmp
strcpy
strcspn
strlen

ws2_32

WSAStartup
WSACleanup

Exports

Exports

DirectPlay8Create
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 524B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 4KB - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3a39de2ddb539600bc503b32d411a8de

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

ntdll

ucrtbase

ws2_32

Exports

Exports

Sections

.text Size: 40KB - Virtual size: 39KB

.data Size: 4KB - Virtual size: 524B

.rodata Size: 4KB - Virtual size: 28B

.rdata Size: 52KB - Virtual size: 48KB

/4 Size: 12KB - Virtual size: 8KB

.edata Size: 72KB - Virtual size: 68KB

.idata Size: 4KB - Virtual size: 1KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 40KB - Virtual size: 39KB

.data
Size: 4KB - Virtual size: 524B

.rodata
Size: 4KB - Virtual size: 28B

.rdata
Size: 52KB - Virtual size: 48KB

/4
Size: 12KB - Virtual size: 8KB

.edata
Size: 72KB - Virtual size: 68KB

.idata
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 2KB