NEAS[.]27816c9b080b93e759f036791ebc21b0_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.27816c9b080b93e759f036791ebc21b0_JC.exe
Size

234KB
MD5

27816c9b080b93e759f036791ebc21b0
SHA1

13f6f1a7bfdf727f1931026fda9a7052846ecba6
SHA256

aae648546735195ccf87edd79e35bccaf34c9f39e0a77fd89ac43b9312fd185c
SHA512

c8250cd69b83ce60c3c3d6ed35097e1a39e4b163883a2b61772c5fb7a20254614f99e3bb0ee5f7b961b3a5f7a7d26c627401e01a024a7a6e288e63de25d23fe5
SSDEEP

6144:lywfyEIe8jJh8JzZ68VHVS0nmljOFmJnoQC2QwP3dZA:lj3IdJhj21S0nmlwmJnoQC2QwPXA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.27816c9b080b93e759f036791ebc21b0_JC.exe

Files

NEAS.27816c9b080b93e759f036791ebc21b0_JC.exe
.exe windows:5 windows x86

3c6e5793e514214727b5614fbe758755

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
CreateFileW
GetFileSize
ReadFile
CloseHandle
VirtualAlloc
GetModuleHandleA
GetProcAddress
VirtualFree
GetProcessHeap
GetCurrentProcess
TerminateProcess
HeapAlloc
HeapFree

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 464B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 229KB - Virtual size: 229KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE