NEAS[.]833a14f37525ff292332a96b67fa9790_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
NEAS.833a14f37525ff292332a96b67fa9790_JC.exe
Size 558KB
Sample231105-ln4a3afg89
SHA256 8dd639e833e6ff47cb2ae0c14d3610ad800235173b51d965a16fe67fa003387c
MD5 833a14f37525ff292332a96b67fa9790
SHA1 8dae089bd6d4b5667cf56b886984c3de41d6e797
SHA512 c0223ce37a32ff357dbda5074cbe3f971a4d9a2de25955eeaadd45c6f3bb1fe4aed2dfa08f3d9bf0db82274300695ae54fa61a094e86c7fc5cb5d9ea98715613
SSDEEP 12288:tLaqeA4PAHge/p1cruArT1xYdR0e1UtQZb/nwbewg:tLaJAIAT/QrNrT1idR0e1d/nwbX
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.833a14f37525ff292332a96b67fa9790_JC.exe

File Explorer

NEAS.833a14f37525ff292332a96b67fa9790_JC.exe

.dll 558KB

NEAS.833a14f37525ff292332a96b67fa9790_JC.exe

IMPHASH 977da93a00c8c967c5054bcabd8a4ebc
SHA256 8dd639e833e6ff47cb2ae0c14d3610ad800235173b51d965a16fe67fa003387c
MD5 833a14f37525ff292332a96b67fa9790
SHA1 8dae089bd6d4b5667cf56b886984c3de41d6e797
SHA512 c0223ce37a32ff357dbda5074cbe3f971a4d9a2de25955eeaadd45c6f3bb1fe4aed2dfa08f3d9bf0db82274300695ae54fa61a094e86c7fc5cb5d9ea98715613
SSDEEP 12288:tLaqeA4PAHge/p1cruArT1xYdR0e1UtQZb/nwbewg:tLaJAIAT/QrNrT1idR0e1d/nwbX
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16305

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ole32

MkParseDisplayName WriteClassStg WriteFmtUserTypeStg ReadClassStg CreateBindCtx StgCreateDocfile CoCreateInstance CreateStreamOnHGlobal CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes ReleaseStgMedium ObjectStublessClient29 ObjectStublessClient28 ObjectStublessClient27 NdrProxyForwardingFunction14 NdrProxyForwardingFunction13 NdrProxyForwardingFunction12 NdrProxyForwardingFunction11 NdrProxyForwardingFunction10 NdrProxyForwardingFunction9 NdrProxyForwardingFunction8 NdrProxyForwardingFunction7 NdrProxyForwardingFunction6 NdrProxyForwardingFunction5 ObjectStublessClient26 ObjectStublessClient25 ObjectStublessClient24 ObjectStublessClient23 ObjectStublessClient22 ObjectStublessClient21 ObjectStublessClient20 ObjectStublessClient19 ObjectStublessClient18 ObjectStublessClient17 ObjectStublessClient16 ObjectStublessClient15 ObjectStublessClient14 ObjectStublessClient13 ObjectStublessClient12 ObjectStublessClient11 ObjectStublessClient10 ObjectStublessClient9 ObjectStublessClient8 NdrProxyForwardingFunction4 NdrProxyForwardingFunction3 ObjectStublessClient7 ObjectStublessClient3 ObjectStublessClient6 ObjectStublessClient5 ObjectStublessClient4 HWND_UserFree HWND_UserUnmarshal HWND_UserMarshal HWND_UserSize HPALETTE_UserFree HPALETTE_UserUnmarshal HPALETTE_UserMarshal HPALETTE_UserSize STGMEDIUM_UserFree STGMEDIUM_UserUnmarshal STGMEDIUM_UserMarshal STGMEDIUM_UserSize CLIPFORMAT_UserFree CLIPFORMAT_UserUnmarshal CLIPFORMAT_UserMarshal CLIPFORMAT_UserSize DcomChannelSetHResult CoReleaseMarshalData CoUnmarshalInterface CoMarshalInterface CoUnmarshalHresult CoMarshalHresult CLSIDFromString CoGetMalloc CoGetClassObject CreateItemMoniker GetRunningObjectTable StringFromGUID2 WdtpInterfacePointer_UserMarshal WdtpInterfacePointer_UserSize WdtpInterfacePointer_UserUnmarshal SetErrorInfo GetErrorInfo CreateErrorInfo

msvcrt

_errno _CIpow _clearfp _XcptFilter malloc _initterm _amsg_exit _except_handler4_common ??1type_info@@UAE@XZ strncpy_s strcat_s strrchr strchr _wsplitpath_s _wmakepath_s _stat sscanf_s _ultow remove _ultow_s free calloc strcpy_s _wcslwr wcsncat_s wcsrchr _CxxThrowException __CxxFrameHandler3 _CIfmod wcsncpy_s wcstoul memmove iswspace _wcsnicmp wcsncmp wcschr _itoa atol atoi floor ceil wcscpy_s wcscat_s _ui64tow swprintf_s _i64tow _itow _wcsicmp _wtoi modf _ftol2 _ftol2_sse memset memcpy

kernel32

TerminateProcess GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter SetErrorMode GetDriveTypeW SetUnhandledExceptionFilter DelayLoadFailureHook GetProcAddress GetLastError FreeLibrary InterlockedCompareExchange LoadLibraryExA TlsGetValue GetSystemDefaultLCID GetUserDefaultLCID GetLocaleInfoA LCMapStringW GetLocaleInfoW InterlockedIncrement HeapAlloc GetProcessHeap UnhandledExceptionFilter InterlockedDecrement LeaveCriticalSection EnterCriticalSection GetNumberFormatW GetCurrencyFormatW CompareStringW GetSystemDirectoryW GetLocalTime IsBadWritePtr IsBadReadPtr GetStringTypeExW InterlockedExchange GetModuleHandleW CloseHandle GetCurrentProcess GetCurrentThread MultiByteToWideChar GetTimeFormatW GetDateFormatW TerminateThread WaitForMultipleObjects SetThreadPriority SetEvent Sleep CreateEventW WaitForSingleObject CreateThread LoadLibraryW WideCharToMultiByte GetVersion GlobalFree GlobalUnlock GlobalLock GlobalAlloc MulDiv GlobalSize GlobalHandle GlobalReAlloc LockResource IsDBCSLeadByte LoadResource FindResourceW _lclose _lread _lwrite _llseek DeleteCriticalSection InitializeCriticalSectionAndSpinCount IsWow64Process lstrlenW GlobalDeleteAtom GlobalAddAtomW GetEnvironmentVariableA TlsFree DebugBreak TlsAlloc TlsSetValue SetLastError Wow64RevertWow64FsRedirection Wow64DisableWow64FsRedirection CreateFileW lstrcmpiA CompareStringA LoadLibraryA CreateFileA SearchPathA GetFullPathNameA SearchPathW GetFullPathNameW UnmapViewOfFile MapViewOfFile GetSystemInfo CreateFileMappingW GetFileSize HeapFree

api-ms-win-core-localregistry-l1-1-0

RegQueryInfoKeyA RegSetValueExW RegEnumKeyExA RegOpenKeyExA RegQueryValueExA RegCreateKeyExW RegOpenKeyExW RegOpenUserClassesRoot RegFlushKey RegSetValueExA RegNotifyChangeKeyValue RegQueryValueExW RegCloseKey

api-ms-win-core-processthreads-l1-1-0

SetThreadToken OpenThreadToken OpenProcessToken

api-ms-win-security-base-l1-1-0

GetTokenInformation EqualSid

rpcrt4

RpcRaiseException NdrGetUserMarshalInfo NdrDllGetClassObject NdrCStdStubBuffer_Release NdrCStdStubBuffer2_Release CreateProxyFromTypeInfo CreateStubFromTypeInfo NdrStubCall2 NdrStubForwardingFunction CStdStubBuffer_DebugServerRelease CStdStubBuffer_DebugServerQueryInterface CStdStubBuffer_CountRefs CStdStubBuffer_IsIIDSupported CStdStubBuffer_Invoke CStdStubBuffer_Disconnect CStdStubBuffer_Connect CStdStubBuffer_AddRef NdrClientCall2 CStdStubBuffer_QueryInterface IUnknown_Release_Proxy IUnknown_AddRef_Proxy IUnknown_QueryInterface_Proxy NdrOleFree NdrOleAllocate NdrGetDcomProtocolVersion

user32

GetIconInfo RegisterClipboardFormatW WinHelpW EnableWindow GetMessageA DispatchMessageA PostQuitMessage GetActiveWindow SetActiveWindow SetFocus GetTopWindow IsWindowUnicode GetClientRect GetDialogBaseUnits CreateWindowExW DestroyWindow GetWindowLongW IsWindow DefWindowProcW RegisterClassW GetClassInfoW DispatchMessageW TranslateMessage GetMessageW PostMessageW RegisterWindowMessageA SystemParametersInfoW GetDC ReleaseDC DrawIcon GetSystemMetrics DestroyIcon GetSysColor CreateIcon CreateCursor CopyIcon CopyImage SetWindowLongW CharNextA GetWindowTextA CharLowerA GetParent SendMessageW GetFocus GetDlgItem GetKeyState LoadStringW

gdi32

CreateHalftonePalette GetTextExtentPointW SetBitmapBits SetDIBits GetBitmapBits SaveDC IntersectClipRect GetWindowOrgEx OffsetViewportOrgEx PlayEnhMetaFile EnumMetaFile RestoreDC SetStretchBltMode SetBkColor SetTextColor GetCurrentObject GetObjectType GetStockObject RealizePalette StretchBlt GetDIBits StretchDIBits DeleteEnhMetaFile DeleteMetaFile PlayMetaFileRecord SelectPalette GetPaletteEntries CreatePalette GetEnhMetaFileBits GetMetaFileBitsEx CreateCompatibleDC CreateCompatibleBitmap BitBlt DeleteDC SetEnhMetaFileBits SetMapMode SetWindowOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx GetWinMetaFileBits GetEnhMetaFileHeader GetObjectW GetBitmapDimensionEx SetMetaFileBitsEx CreateBitmap PatBlt DeleteObject CreateFontIndirectW GetDeviceCaps SelectObject GetTextMetricsW GetTextFaceW EnumFontFamiliesExW Escape CreateDIBSection CreateDIBitmap

BSTR_UserFree BSTR_UserMarshal BSTR_UserSize BSTR_UserUnmarshal BstrFromVector ClearCustData CreateDispTypeInfo CreateErrorInfo CreateStdDispatch CreateTypeLib CreateTypeLib2 DispCallFunc DispGetIDsOfNames DispGetParam DispInvoke DllCanUnloadNow DllGetClassObject DllRegisterServer DllUnregisterServer DosDateTimeToVariantTime GetActiveObject GetAltMonthNames GetErrorInfo GetRecordInfoFromGuids GetRecordInfoFromTypeInfo GetVarConversionLocaleSetting LHashValOfNameSys LHashValOfNameSysA LPSAFEARRAY_Marshal LPSAFEARRAY_Size LPSAFEARRAY_Unmarshal LPSAFEARRAY_UserFree LPSAFEARRAY_UserMarshal LPSAFEARRAY_UserSize LPSAFEARRAY_UserUnmarshal LoadRegTypeLib LoadTypeLib LoadTypeLibEx OACleanup OACreateTypeLib2 OaBuildVersion OaEnablePerUserTLibRegistration OleCreateFontIndirect OleCreatePictureIndirect OleCreatePropertyFrame OleCreatePropertyFrameIndirect OleIconToCursor OleLoadPicture OleLoadPictureEx OleLoadPictureFile OleLoadPictureFileEx OleLoadPicturePath OleSavePictureFile OleTranslateColor QueryPathOfRegTypeLib RegisterActiveObject RegisterTypeLib RegisterTypeLibForUser RevokeActiveObject SafeArrayAccessData SafeArrayAllocData SafeArrayAllocDescriptor SafeArrayAllocDescriptorEx SafeArrayCopy SafeArrayCopyData SafeArrayCreate SafeArrayCreateEx SafeArrayCreateVector SafeArrayCreateVectorEx SafeArrayDestroy SafeArrayDestroyData SafeArrayDestroyDescriptor SafeArrayGetDim SafeArrayGetElement SafeArrayGetElemsize SafeArrayGetIID SafeArrayGetLBound SafeArrayGetRecordInfo SafeArrayGetUBound SafeArrayGetVartype SafeArrayLock SafeArrayPtrOfIndex SafeArrayPutElement SafeArrayRedim SafeArraySetIID SafeArraySetRecordInfo SafeArrayUnaccessData SafeArrayUnlock SetErrorInfo SetOaNoCache SetVarConversionLocaleSetting SysAllocString SysAllocStringByteLen SysAllocStringLen SysFreeString SysReAllocString SysReAllocStringLen SysStringByteLen SysStringLen SystemTimeToVariantTime UnRegisterTypeLib UnRegisterTypeLibForUser VARIANT_UserFree VARIANT_UserMarshal VARIANT_UserSize VARIANT_UserUnmarshal VarAbs VarAdd VarAnd VarBoolFromCy VarBoolFromDate VarBoolFromDec VarBoolFromDisp VarBoolFromI1 VarBoolFromI2 VarBoolFromI4 VarBoolFromI8 VarBoolFromR4 VarBoolFromR8 VarBoolFromStr VarBoolFromUI1 VarBoolFromUI2 VarBoolFromUI4 VarBoolFromUI8 VarBstrCat VarBstrCmp VarBstrFromBool VarBstrFromCy VarBstrFromDate VarBstrFromDec VarBstrFromDisp VarBstrFromI1 VarBstrFromI2 VarBstrFromI4 VarBstrFromI8 VarBstrFromR4 VarBstrFromR8 VarBstrFromUI1 VarBstrFromUI2 VarBstrFromUI4 VarBstrFromUI8 VarCat VarCmp VarCyAbs VarCyAdd VarCyCmp VarCyCmpR8 VarCyFix VarCyFromBool VarCyFromDate VarCyFromDec VarCyFromDisp VarCyFromI1 VarCyFromI2 VarCyFromI4 VarCyFromI8 VarCyFromR4 VarCyFromR8 VarCyFromStr VarCyFromUI1 VarCyFromUI2 VarCyFromUI4 VarCyFromUI8 VarCyInt VarCyMul VarCyMulI4 VarCyMulI8 VarCyNeg VarCyRound VarCySub VarDateFromBool VarDateFromCy VarDateFromDec VarDateFromDisp VarDateFromI1 VarDateFromI2 VarDateFromI4 VarDateFromI8 VarDateFromR4 VarDateFromR8 VarDateFromStr VarDateFromUI1 VarDateFromUI2 VarDateFromUI4 VarDateFromUI8 VarDateFromUdate VarDateFromUdateEx VarDecAbs VarDecAdd VarDecCmp VarDecCmpR8 VarDecDiv VarDecFix VarDecFromBool VarDecFromCy VarDecFromDate VarDecFromDisp VarDecFromI1 VarDecFromI2 VarDecFromI4 VarDecFromI8 VarDecFromR4 VarDecFromR8 VarDecFromStr VarDecFromUI1 VarDecFromUI2 VarDecFromUI4 VarDecFromUI8 VarDecInt VarDecMul VarDecNeg VarDecRound VarDecSub VarDiv VarEqv VarFix VarFormat VarFormatCurrency VarFormatDateTime VarFormatFromTokens VarFormatNumber VarFormatPercent VarI1FromBool VarI1FromCy VarI1FromDate VarI1FromDec VarI1FromDisp VarI1FromI2 VarI1FromI4 VarI1FromI8 VarI1FromR4 VarI1FromR8 VarI1FromStr VarI1FromUI1 VarI1FromUI2 VarI1FromUI4 VarI1FromUI8 VarI2FromBool VarI2FromCy VarI2FromDate VarI2FromDec VarI2FromDisp VarI2FromI1 VarI2FromI4 VarI2FromI8 VarI2FromR4 VarI2FromR8 VarI2FromStr VarI2FromUI1 VarI2FromUI2 VarI2FromUI4 VarI2FromUI8 VarI4FromBool VarI4FromCy VarI4FromDate VarI4FromDec VarI4FromDisp VarI4FromI1 VarI4FromI2 VarI4FromI8 VarI4FromR4 VarI4FromR8 VarI4FromStr VarI4FromUI1 VarI4FromUI2 VarI4FromUI4 VarI4FromUI8 VarI8FromBool VarI8FromCy VarI8FromDate VarI8FromDec VarI8FromDisp VarI8FromI1 VarI8FromI2 VarI8FromR4 VarI8FromR8 VarI8FromStr VarI8FromUI1 VarI8FromUI2 VarI8FromUI4 VarI8FromUI8 VarIdiv VarImp VarInt VarMod VarMonthName VarMul VarNeg VarNot VarNumFromParseNum VarOr VarParseNumFromStr VarPow VarR4CmpR8 VarR4FromBool VarR4FromCy VarR4FromDate VarR4FromDec VarR4FromDisp VarR4FromI1 VarR4FromI2 VarR4FromI4 VarR4FromI8 VarR4FromR8 VarR4FromStr VarR4FromUI1 VarR4FromUI2 VarR4FromUI4 VarR4FromUI8 VarR8FromBool VarR8FromCy VarR8FromDate VarR8FromDec VarR8FromDisp VarR8FromI1 VarR8FromI2 VarR8FromI4 VarR8FromI8 VarR8FromR4 VarR8FromStr VarR8FromUI1 VarR8FromUI2 VarR8FromUI4 VarR8FromUI8 VarR8Pow VarR8Round VarRound VarSub VarTokenizeFormatString VarUI1FromBool VarUI1FromCy VarUI1FromDate VarUI1FromDec VarUI1FromDisp VarUI1FromI1 VarUI1FromI2 VarUI1FromI4 VarUI1FromI8 VarUI1FromR4 VarUI1FromR8 VarUI1FromStr VarUI1FromUI2 VarUI1FromUI4 VarUI1FromUI8 VarUI2FromBool VarUI2FromCy VarUI2FromDate VarUI2FromDec VarUI2FromDisp VarUI2FromI1 VarUI2FromI2 VarUI2FromI4 VarUI2FromI8 VarUI2FromR4 VarUI2FromR8 VarUI2FromStr VarUI2FromUI1 VarUI2FromUI4 VarUI2FromUI8 VarUI4FromBool VarUI4FromCy VarUI4FromDate VarUI4FromDec VarUI4FromDisp VarUI4FromI1 VarUI4FromI2 VarUI4FromI4 VarUI4FromI8 VarUI4FromR4 VarUI4FromR8 VarUI4FromStr VarUI4FromUI1 VarUI4FromUI2 VarUI4FromUI8 VarUI8FromBool VarUI8FromCy VarUI8FromDate VarUI8FromDec VarUI8FromDisp VarUI8FromI1 VarUI8FromI2 VarUI8FromI8 VarUI8FromR4 VarUI8FromR8 VarUI8FromStr VarUI8FromUI1 VarUI8FromUI2 VarUI8FromUI4 VarUdateFromDate VarWeekdayName VarXor VariantChangeType VariantChangeTypeEx VariantClear VariantCopy VariantCopyInd VariantInit VariantTimeToDosDateTime VariantTimeToSystemTime VectorFromBstr