NEAS[.]331568e45664dfb0b8ec0201c0418240_JC[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.331568e45664dfb0b8ec0201c0418240_JC.exe
Size

803KB
MD5

331568e45664dfb0b8ec0201c0418240
SHA1

a5efd2d86506f35941f780e4e7ea5bf0d6e84e30
SHA256

0140a75130926b5a347273ab151bd227d5548c6002555dc4924b447b192b86d8
SHA512

4e4eebac23b85dfb66f648ebffdee8f5fc422a20def1d68ba0d0b3a2a8e3e93430394b479ccf54a38498c62085c1e28813b4f30617cb9b75ba8f83cf2815562f
SSDEEP

24576:W+M+V/UHxrcGFajjEOjfRZSx4IHBUVGCkjsTrwh:FBURNWjEOjZ8xqGCkYT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.331568e45664dfb0b8ec0201c0418240_JC.exe

Files

NEAS.331568e45664dfb0b8ec0201c0418240_JC.exe
.exe windows:5 windows x86

c8fa08c979955d41705d2bff6914272e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
CryptHashData
DeregisterEventSource
ReportEventA
RegisterEventSourceA

kernel32

QueryDosDeviceA
CreateDirectoryW
OpenProcess
FindFirstFileA
GetLogicalDriveStringsA
GetLastError
FindNextFileA
HeapReAlloc
HeapAlloc
HeapFree
HeapDestroy
HeapCreate
CreateFileA
MapViewOfFile
UnmapViewOfFile
InterlockedDecrement
CreateFileMappingA
GetCurrentProcess
VirtualQueryEx
ReadProcessMemory
GetSystemInfo
ReadFile
CreateFileW
GetCurrentThreadId
GetProcAddress
GetModuleHandleA
GetVersion
GetFileType
GetStdHandle
InterlockedIncrement
SwitchToThread
MultiByteToWideChar
GetTickCount
QueryPerformanceCounter
GlobalMemoryStatus
FreeLibrary
LoadLibraryA
GetVersionExA
FlushConsoleInputBuffer
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
CloseHandle
ReleaseMutex
CreateMutexA
WaitForSingleObject
TlsFree
TlsAlloc
TlsSetValue
TlsGetValue
GetCurrentProcessId
GetFileAttributesW
GetFileSizeEx
GetProcessHeap
lstrlenA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
Sleep
InterlockedExchange
InterlockedCompareExchange

user32

MessageBoxA
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW

ole32

CoCreateInstance
CoUninitialize
CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket

oleaut32

SysFreeString
VariantInit
VariantClear
SysAllocString

psapi

GetProcessImageFileNameA

msvcr90

_controlfp_s
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
memmove_s
fputc
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
sprintf_s
free
ungetc
fgetpos
memchr
fflush
atoi
fgetc
localeconv
fsetpos
_invalid_parameter_noinfo
fopen
setvbuf
??_V@YAXPAX@Z
??3@YAXPAX@Z
memcpy_s
fwrite
strcspn
fseek
fclose
??2@YAPAXI@Z
tolower
_wassert
_time64
_snprintf
malloc
fputs
fopen_s
iscntrl
strnlen
isalnum
isdigit
abort
__iob_func
strtol
fprintf
fread
ftell
sscanf
strstr
_errno
ferror
strrchr
longjmp
atol
realloc
getc
clearerr
exit
strncmp
strchr
strcat_s
strncpy_s
_stricmp
sprintf
_strnicmp
strerror
_lseeki64
memset
memcpy
qsort
isspace
memmove
strncpy
_strtoi64
_vsnprintf
strtoul
getenv
wcsstr
vfprintf
_exit
raise
strcmp
isxdigit
isupper
strtod
_HUGE
_setmode
_fileno
feof
fgets
_wfopen
_gmtime64
signal
_getch
___lc_codepage_func
___lc_handle_func
_CxxThrowException
__CxxFrameHandler3
setlocale
__uncaught_exception
_wfsopen
mbstowcs_s
__crtLCMapStringA
__pctype_func
_calloc_crt
islower
_free_locale
_close
_write
_open
_amsg_exit
__getmainargs
_cexit
_XcptFilter
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_except_handler4_common
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_crt_debugger_hook
?terminate@@YAXXZ
_setjmp3

Sections

.text
Size: 566KB - Virtual size: 565KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 189KB - Virtual size: 189KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c8fa08c979955d41705d2bff6914272e

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

ole32

oleaut32

psapi

msvcr90

Sections

.text Size: 566KB - Virtual size: 565KB

.rdata Size: 189KB - Virtual size: 189KB

.data Size: 7KB - Virtual size: 16KB

.rsrc Size: 1024B - Virtual size: 688B

.reloc Size: 39KB - Virtual size: 38KB

.text
Size: 566KB - Virtual size: 565KB

.rdata
Size: 189KB - Virtual size: 189KB

.data
Size: 7KB - Virtual size: 16KB

.rsrc
Size: 1024B - Virtual size: 688B

.reloc
Size: 39KB - Virtual size: 38KB