NEAS[.]6b3a67bf200e602cfb30bb9478472060_JC[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.6b3a67bf200e602cfb30bb9478472060_JC.exe
Size

251KB
MD5

6b3a67bf200e602cfb30bb9478472060
SHA1

0eff062a43245fb4302c2920f4e032d7d5d42ed8
SHA256

33f0c1a31304abce92ee3a67864a188e4cbcd38a374ea7c3e82e8b2fecc7924a
SHA512

258052dd9664779a626ec38a4a203ae5ef166f5c4b29ed0f40d82aa52b1aa2a236899ab0daba9095b8ab7401ee4cb4127dcc87cd38fe6f10904888fa7b5cfdd1
SSDEEP

6144:mbFspmU57W9bBAewhrnKvSrkR10efUKC8Pv8fekML:mB8PmwKvSQztfwIvUbML

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.6b3a67bf200e602cfb30bb9478472060_JC.exe

Files

NEAS.6b3a67bf200e602cfb30bb9478472060_JC.exe
.exe windows:10 windows x86

ec65350ef20c54293fb94b3ea4ed0fe4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__CxxFrameHandler3
memcpy
??0exception@@QAE@ABQBD@Z
memmove
_XcptFilter
??1type_info@@UAE@XZ
_controlfp
??0exception@@QAE@ABQBDH@Z
?what@exception@@UBEPBDXZ
_onexit
_CxxThrowException
toupper
bsearch
wcsncmp
_wcsnicmp
_wcsicmp
__p__commode
_amsg_exit
__wgetmainargs
__set_app_type
wcsncpy_s
malloc
memmove_s
free
exit
_vsnprintf_s
_wtoi64
_exit
__dllonexit
strerror
_itow_s
_unlock
_cexit
__p__fmode
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_purecall
_wtoi
__setusermatherr
_lock
?terminate@@YAXXZ
memcpy_s
_initterm
_except_handler4_common
_errno
memcmp
_vsnwprintf
realloc
memset

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventActivityIdControl
EventUnregister
EventSetInformation
EventWriteTransfer
EventProviderEnabled

api-ms-win-security-base-l1-1-0

SetSecurityDescriptorOwner
GetAce
InitializeSecurityDescriptor
AddAce
IsValidSid
InitializeAcl
GetAclInformation
CopySid
CreateWellKnownSid
SetSecurityDescriptorDacl
GetLengthSid
AddAccessAllowedAce
SetSecurityDescriptorGroup
GetTokenInformation

oleaut32

VarUI4FromStr

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadLibraryExW
GetModuleHandleExW
LoadStringW
GetModuleFileNameA
SizeofResource
LoadResource
GetModuleFileNameW
GetProcAddress
FindResourceExW
GetModuleHandleW

api-ms-win-core-windowserrorreporting-l1-1-0

WerSetFlags

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW
LookupAccountNameW

api-ms-win-core-com-l1-1-0

PropVariantCopy
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
PropVariantClear
CoMarshalInterface
CoTaskMemRealloc
CoReleaseMarshalData
CreateStreamOnHGlobal
StringFromCLSID
CoInitializeEx
CoGetMarshalSizeMax
CoUninitialize
CoInitializeSecurity

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete
SleepConditionVariableSRW
WakeAllConditionVariable
InitOnceExecuteOnce
Sleep

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
ResetEvent
WaitForSingleObjectEx
DeleteCriticalSection
AcquireSRWLockShared
ReleaseSRWLockShared
CreateMutexExW
InitializeCriticalSection
ReleaseSemaphore
InitializeCriticalSectionEx
ReleaseMutex
SetEvent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
CreateSemaphoreExW
CreateEventW
OpenEventW
WaitForSingleObject
OpenSemaphoreW

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap
HeapSetInformation

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetErrorMode
RaiseException
SetLastError
SetUnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle
GetHandleInformation

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken
OpenProcessToken
GetCurrentThread
SetPriorityClass
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
GetProcessTimes

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegEnumValueW
RegQueryInfoKeyW
RegDeleteKeyExW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegGetValueW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-memory-l1-1-0

MapViewOfFile
UnmapViewOfFile
CreateFileMappingW

api-ms-win-core-processthreads-l1-1-1

GetThreadTimes
SetProcessMitigationPolicy

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringOrdinal
WideCharToMultiByte

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW
FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak
OutputDebugStringA

api-ms-win-core-heap-l2-1-0

GlobalFree
LocalAlloc
GlobalAlloc

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-processenvironment-l1-1-0

SearchPathW
ExpandEnvironmentStringsW

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage
GetSystemDefaultUILanguage

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetVersionExW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

tquery

ciNewNoThrow
ciDelete
ciNew

api-ms-win-core-timezone-l1-1-0

SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW

ntdll

EtwEventWriteTransfer
RtlNtStatusToDosError
RtlIsStateSeparationEnabled
RtlGetPersistedStateLocation

api-ms-win-core-file-l1-1-0

CreateFileW

api-ms-win-rtcore-ntuser-window-l1-1-0

DispatchMessageW
PeekMessageW

api-ms-win-rtcore-ntuser-synch-l1-1-0

MsgWaitForMultipleObjects

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 119KB - Virtual size: 119KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

futgurh
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ec65350ef20c54293fb94b3ea4ed0fe4

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-eventing-provider-l1-1-0

api-ms-win-security-base-l1-1-0

oleaut32

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-windowserrorreporting-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-apiquery-l1-1-0

tquery

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

ntdll

api-ms-win-core-file-l1-1-0

api-ms-win-rtcore-ntuser-window-l1-1-0

api-ms-win-rtcore-ntuser-synch-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 119KB - Virtual size: 119KB

.data Size: 1024B - Virtual size: 2KB

.idata Size: 8KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 24B

.rsrc Size: 85KB - Virtual size: 85KB

.reloc Size: 35KB - Virtual size: 36KB

futgurh Size: - Virtual size: 4KB

.text
Size: 119KB - Virtual size: 119KB

.data
Size: 1024B - Virtual size: 2KB

.idata
Size: 8KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 24B

.rsrc
Size: 85KB - Virtual size: 85KB

.reloc
Size: 35KB - Virtual size: 36KB

futgurh
Size: - Virtual size: 4KB