NEAS[.]e0f634839fb2e821072544c40f6bf520_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.e0f634839fb2e821072544c40f6bf520_JC.exe
Size

563KB
MD5

e0f634839fb2e821072544c40f6bf520
SHA1

371202ee74d088a23589e50464a5ff0572357420
SHA256

d49be24c2e2487f7d24bbb4894486d688a14399144bc8621fa718eddb44b9325
SHA512

470747c386f65df1f800a3beb224d91b58dd57068a5a196417ee98f21783077e8c88baeb04da0554822ce406e4a0742c3c96a05a7c400fce00ca5788fd9ff7d0
SSDEEP

12288:faQpW53c2IrNVhWIerOenXLV2Uxi96Z35XQg8/kWLzu9g27RKKhS:fD4W2IJVAjx7V2Uxi96rQgakSSrTS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.e0f634839fb2e821072544c40f6bf520_JC.exe

Files

NEAS.e0f634839fb2e821072544c40f6bf520_JC.exe
.exe windows:6 windows x64

c506d17884de6dbdd16d115d30b229ae

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

FreeLibrary
GetModuleHandleA

user32

FindWindowW
RegisterClassExW

advapi32

CryptGetHashParam
GetUserNameA

msvcp140

??0_Lockit@std@@QEAA@H@Z

winhttp

WinHttpOpen

ntdll

RtlCaptureContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strrchr

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-convert-l1-1-0

strtoll

api-ms-win-crt-stdio-l1-1-0

ungetc

api-ms-win-crt-string-l1-1-0

isalnum

api-ms-win-crt-runtime-l1-1-0

__p___argv

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_gmtime64

ws2_32

WSAIoctl

normaliz

IdnToAscii

wldap32

ord211

crypt32

CryptStringToBinaryA

shell32

ShellAboutA

Sections

.rdata
Size: - Virtual size: 510KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 155KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 535KB - Virtual size: 535KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c506d17884de6dbdd16d115d30b229ae

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

msvcp140

winhttp

ntdll

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

ws2_32

normaliz

wldap32

crypt32

shell32

Sections

.rdata Size: - Virtual size: 510KB

.data Size: - Virtual size: 155KB

.pdata Size: - Virtual size: 21KB

.rsrc Size: 27KB - Virtual size: 57KB

.rdata Size: 535KB - Virtual size: 535KB

.rdata
Size: - Virtual size: 510KB

.data
Size: - Virtual size: 155KB

.pdata
Size: - Virtual size: 21KB

.rsrc
Size: 27KB - Virtual size: 57KB

.rdata
Size: 535KB - Virtual size: 535KB