Static task
static1
Behavioral task
behavioral1
Sample
NEAS.54f0f0e053eb449f1563dfa113bafac0_JC.exe
Resource
win7-20231023-en
General
-
Target
NEAS.54f0f0e053eb449f1563dfa113bafac0_JC.exe
-
Size
875KB
-
MD5
54f0f0e053eb449f1563dfa113bafac0
-
SHA1
0d8a157b38990aea1ea295bb963661d8fc350141
-
SHA256
acb27f2d6beef36da3388ccf90b49c7ce3246c39672afa522a45c5a1aa2a0fa4
-
SHA512
714e622f96479d679263b38608b4d9bbbc21a6267d1b7796c20aebbb5c727f643ae73263092d1ae76f00d2e5e866bffe780da879753bcccda6b5fae457710da2
-
SSDEEP
24576:7r+kPjU/Fi1N3RUDHNmdPCAaq8Nozgi/rE0TOj:zIc8HNUPCAaq8Wdo0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.54f0f0e053eb449f1563dfa113bafac0_JC.exe
Files
-
NEAS.54f0f0e053eb449f1563dfa113bafac0_JC.exe.exe windows:6 windows x64
7b77d28ac74d49db492fa5af06dd5ba2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateEventW
Sleep
CreateThread
GetCurrentThreadId
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
SizeofResource
WaitForSingleObject
lstrcmpiW
MultiByteToWideChar
SetEndOfFile
WriteConsoleW
CreateFileW
GetProcessHeap
SetStdHandle
FreeEnvironmentStringsW
SetEvent
CloseHandle
GetCommandLineW
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError
RaiseException
FindResourceW
DecodePointer
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
LocalFree
EncodePointer
WideCharToMultiByte
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlUnwindEx
RtlPcToFileHeader
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
HeapAlloc
HeapSize
HeapReAlloc
RtlUnwind
user32
TranslateMessage
GetMessageW
DispatchMessageW
PostThreadMessageW
CharUpperW
CharNextW
advapi32
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
RegSetValueExW
ole32
CoRevokeClassObject
CoResumeClassObjects
CoCreateInstance
CoAddRefServerProcess
CoRegisterClassObject
CoUninitialize
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoInitialize
OleRun
CoReleaseServerProcess
oleaut32
GetRecordInfoFromGuids
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayDestroy
SafeArrayCreateEx
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
SafeArrayCopy
SysStringLen
SysAllocString
SysFreeString
GetErrorInfo
VarUI4FromStr
Sections
.text Size: 186KB - Virtual size: 186KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 384B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE