NEAS[.]5ee9939ae41a22ef42b1912933d70970_JC[.]exe

General

Target

NEAS.5ee9939ae41a22ef42b1912933d70970_JC.exe
Size

276KB
MD5

5ee9939ae41a22ef42b1912933d70970
SHA1

78b3c20f8a66a51749028a7ffc2afe2d6a1fcc46
SHA256

7657c16912198815d871c0fd6b28793f5eb519cd2d6d27d2446ddc53e85f6a47
SHA512

2858fd9a5178bb93d5cff9b77f1387f2e1a6fcff3bebda5e4d5d772db94f4d2520b219ad516b8f5de963139cb840aecafec986f3d5f2ef2714f80bab46004f65
SSDEEP

6144:b//lOT+4m9pK13sqt6rj+8binwnE7Qea/6RHi:bNqvm/c3sqt6Ea/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.5ee9939ae41a22ef42b1912933d70970_JC.exe

Files

NEAS.5ee9939ae41a22ef42b1912933d70970_JC.exe
.exe windows:4 windows x86

c1660cd6072e4f8d3c76e9fc977e3b4c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

gethostbyname
shutdown
closesocket
setsockopt
send
recv
socket
WSAGetLastError
ioctlsocket
htons
getservbyname
ntohs
connect
WSAStartup
WSACleanup

kernel32

GetFullPathNameA
GetCurrentDirectoryA
SetEndOfFile
GetLocaleInfoW
SetStdHandle
CompareStringW
CompareStringA
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
LoadLibraryA
GetOEMCP
LeaveCriticalSection
EnterCriticalSection
GetWindowsDirectoryA
CloseHandle
GetDriveTypeA
WaitNamedPipeA
CreateFileA
GetLastError
InitializeCriticalSection
TlsAlloc
DeleteCriticalSection
TlsFree
TlsSetValue
TlsGetValue
InterlockedIncrement
ReadFile
WriteFile
CreateSemaphoreA
InterlockedDecrement
SetNamedPipeHandleState
ExitProcess
TerminateProcess
GetCurrentProcess
GetCommandLineA
GetVersion
HeapAlloc
HeapFree
WideCharToMultiByte
GetTimeZoneInformation
MultiByteToWideChar
Sleep
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
WriteConsoleA
HeapReAlloc
GetFileAttributesA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetCurrentThreadId
SetLastError
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
VirtualAlloc
SetEnvironmentVariableW
SetEnvironmentVariableA
GetCPInfo
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
FlushFileBuffers
GetProcAddress
RaiseException
SetFilePointer
GetACP

advapi32

RegEnumValueA
RegCloseKey
RegOpenKeyExA

Sections

.text
Size: 120KB - Virtual size: 119KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 140KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c1660cd6072e4f8d3c76e9fc977e3b4c

Headers

File Characteristics

Imports

wsock32

kernel32

advapi32

Sections

.text Size: 120KB - Virtual size: 119KB

.rdata Size: 12KB - Virtual size: 9KB

.data Size: 140KB - Virtual size: 137KB

.text
Size: 120KB - Virtual size: 119KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 140KB - Virtual size: 137KB