NEAS[.]05dbf369032f1e123e317925a3bb1a40_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.05dbf369032f1e123e317925a3bb1a40_JC.exe
Size

53KB
MD5

05dbf369032f1e123e317925a3bb1a40
SHA1

8305aac7b3e28448ef5cd2f8cb3bd1fd5e9d3b0a
SHA256

fa6c3997cbdb367354419e1612366a1bdfbf72018bfb576a426193742dfd9a74
SHA512

f3e170c733694d50687be91fcc726efa9478e9bae6b33cca7651ea85462a5ab2c5748254ac2cb563ffa352557f22b7fe49c147bca665fde7b200f3e3c12e9c2d
SSDEEP

1536:vnY1VQi9nnuJ1SF8JxtT6wsal7m82STsv3O:vY1VQ0nuaF8hca882S6e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.05dbf369032f1e123e317925a3bb1a40_JC.exe

Files

NEAS.05dbf369032f1e123e317925a3bb1a40_JC.exe
.exe windows:5 windows x86

cee2cc2bb3085b7e03ac910a1dc9dfec

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__set_app_type
_c_exit
_exit
_XcptFilter
_cexit
exit
_acmdln
__getmainargs
_initterm
_controlfp
_except_handler3
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

kernel32

GetSystemDirectoryW
WideCharToMultiByte
lstrcpynW
lstrcatW
lstrcpyW
lstrlenW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetCurrentDirectoryW
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoA
OpenEventW
SetEvent
GetCurrentThreadId
LocalFree
LocalAlloc
CloseHandle
RegisterConsoleIME
UnregisterConsoleIME
TerminateProcess

gdi32

GetStockObject

user32

IsWindowEnabled
DefWindowProcW
EnableWindow
DestroyWindow
UnregisterClassW
CreateWindowExW
GetSystemMetrics
RegisterClassW
LoadCursorW
LoadIconW
LoadStringW
DispatchMessageW
TranslateMessage
GetMessageW
GetKeyboardLayoutNameW
GetKeyState
PostQuitMessage
SendMessageTimeoutW
GetKeyboardLayoutList
PostMessageW
ActivateKeyboardLayout
AttachThreadInput
SetForegroundWindow

ntdll

RtlCopyLuid
NtClose
NtQueryInformationToken
NtOpenProcessToken
RtlLeaveCriticalSection
RtlUnicodeToMultiByteSize
RtlInitializeCriticalSection
RtlEnterCriticalSection

imm32

ImmNotifyIME
ImmGetOpenStatus
ImmIsIME
ImmEscapeW
ImmGetIMEFileNameW
ImmSimulateHotKey
ImmSetConversionStatus
ImmGetCandidateListW
ImmGetConversionStatus
ImmReleaseContext
ImmGetContext
ImmDisableTextFrameService
ImmGetCompositionStringW
ImmSetActiveContextConsoleIME
ImmTranslateMessage
ImmSetOpenStatus
ImmAssociateContext
ImmGetProperty
ImmCreateContext
ImmGetGuideLineW
ImmCallImeConsoleIME
ImmDestroyContext

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

xfzkddo
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cee2cc2bb3085b7e03ac910a1dc9dfec

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

advapi32

kernel32

gdi32

user32

ntdll

imm32

Sections

.text Size: 21KB - Virtual size: 21KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 30KB - Virtual size: 31KB

xfzkddo Size: - Virtual size: 4KB

.text
Size: 21KB - Virtual size: 21KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 30KB - Virtual size: 31KB

xfzkddo
Size: - Virtual size: 4KB