NEAS[.]c20a4e9911606ae304063f37b1c8a490_JC[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.c20a4e9911606ae304063f37b1c8a490_JC.exe
Size

638KB
MD5

c20a4e9911606ae304063f37b1c8a490
SHA1

f8dfe2ba2485901f37425ed058bf55f86bf020b9
SHA256

3d133887bc76c9e1856ab1f2af3ec86a9f4ebd6104bae1c8905fcc5e766adcbc
SHA512

08259b1fd77f42e28f98d9efea1f6865f35a9165a9129807a40912d5717629ab974d537f813642a048c2d299c5fb6fa7968c088d8663f63f06eb457bdf3851f7
SSDEEP

12288:57h3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:th1N3RUDHNmdPCAaq8Nozgi/rE0TOj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.c20a4e9911606ae304063f37b1c8a490_JC.exe

Files

NEAS.c20a4e9911606ae304063f37b1c8a490_JC.exe
.exe windows:10 windows x64

a220beeafc75603adf8a3e0eebda23d9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

advapi32

EventWriteTransfer
RegCreateKeyExW
RegDeleteValueW
RegGetValueW
RegCloseKey
OpenThreadToken

kernel32

LoadLibraryExW
SetEnvironmentVariableW
GetModuleHandleExW
OutputDebugStringW
GetModuleHandleW
GetCurrentThread
FormatMessageW
RaiseException
GetLastError
SetLastError
GetProcAddress
GetModuleFileNameA
GetCurrentThreadId
CloseHandle
ExpandEnvironmentStringsW
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
TerminateProcess

msvcrt

_CxxThrowException
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_callnewh
_XcptFilter
_amsg_exit
__wgetmainargs
__set_app_type
exit
_exit
_cexit
__setusermatherr
??0exception@@QEAA@AEBQEBD@Z
__C_specific_handler
_fmode
_commode
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UEAA@XZ
_purecall
_vsnwprintf
malloc
memcpy
_initterm
__CxxFrameHandler3
free
memmove
_wcsicmp
??3@YAXPEAX@Z
??0exception@@QEAA@AEBQEBDH@Z
memset

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

userenv

ExpandEnvironmentStringsForUserW

diagtrack

RunDll32Main

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a220beeafc75603adf8a3e0eebda23d9

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

ntdll

userenv

diagtrack

Sections

.text Size: 18KB - Virtual size: 18KB

.rdata Size: 13KB - Virtual size: 13KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 35KB - Virtual size: 35KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 18KB - Virtual size: 18KB

.rdata
Size: 13KB - Virtual size: 13KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 35KB - Virtual size: 35KB

.reloc
Size: 568KB - Virtual size: 572KB