Static task
static1
Behavioral task
behavioral1
Sample
NEAS.8d9f50d5028499b3f4fb8689cdd80d00_JC.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEAS.8d9f50d5028499b3f4fb8689cdd80d00_JC.exe
Resource
win10v2004-20231025-en
General
-
Target
NEAS.8d9f50d5028499b3f4fb8689cdd80d00_JC.exe
-
Size
246KB
-
MD5
8d9f50d5028499b3f4fb8689cdd80d00
-
SHA1
ad90afdc50bb16b03ef312b5bb6c6642d56f0fcc
-
SHA256
b2089a920965b7c6325234e8b0acd1f760eced2b5ce1e30535bfa4193d3eb4ea
-
SHA512
38ef5246b29518bb0be0b065657d63acf207a31dc28ba7b6a82cf044a711123793d1e7b35813f62110af2a5fb63b406aac5e8d1e8975b21fc7f3cdfe5f1366d9
-
SSDEEP
6144:w5PfdPffadWjYagikGkUzjWcmTn5eNajMKYS5Tu1BfM:wjalagi1kiyn5eh3S5S1BE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.8d9f50d5028499b3f4fb8689cdd80d00_JC.exe
Files
-
NEAS.8d9f50d5028499b3f4fb8689cdd80d00_JC.exe.exe windows:1 windows x86
59c54023e46a803f6b256d7017051ca0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
Imports
crypt32
CryptBinaryToStringA
ole32
CoInitialize
CoUninitialize
user32
DefWindowProcW
DestroyWindow
DispatchMessageW
EnableWindow
GetClientRect
GetDC
GetDlgItem
GetKeyState
GetSystemMetrics
GetWindowLongW
LoadAcceleratorsA
LoadCursorA
LoadCursorW
LoadIconA
LoadStringW
MessageBoxW
PostMessageW
PostQuitMessage
RegisterClassW
ReleaseDC
SendMessageW
SetWindowLongW
ShowWindow
wsprintfW
CreateWindowExW
kernel32
CloseHandle
GetCurrentProcess
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetStartupInfoW
GetTickCount
GetVersionExW
LoadLibraryA
VirtualProtect
lstrlenW
LoadLibraryW
ulib
??0ARGUMENT_LEXEMIZER@@QAE@XZ
??0ARRAY@@QAE@XZ
??0DSTRING@@QAE@XZ
??0FLAG_ARGUMENT@@QAE@XZ
??0STRING_ARGUMENT@@QAE@XZ
??1ARGUMENT_LEXEMIZER@@UAE@XZ
??1ARRAY@@UAE@XZ
??1DSTRING@@UAE@XZ
??1OBJECT@@UAE@XZ
??1STRING_ARGUMENT@@UAE@XZ
?DoParsing@ARGUMENT_LEXEMIZER@@QAEEPAVARRAY@@@Z
?Initialize@ARGUMENT_LEXEMIZER@@QAEEPAVARRAY@@@Z
?Initialize@ARRAY@@QAEEKK@Z
?Initialize@FLAG_ARGUMENT@@QAEEPAD@Z
?Initialize@STRING_ARGUMENT@@QAEEPAD@Z
?IsValueSet@ARGUMENT@@QAEEXZ
?PrepareToParse@ARGUMENT_LEXEMIZER@@QAEEPAVWSTRING@@@Z
?Put@ARRAY@@UAEEPAVOBJECT@@@Z
?SetCaseSensitive@ARGUMENT_LEXEMIZER@@QAEXE@Z
?Initialize@WSTRING@@QAEEPBDK@Z
ntdll
RtlFreeHeap
advapi32
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
gdi32
GetObjectW
Sections
AUTO Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DGROUP Size: 128KB - Virtual size: 364KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 226B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size:
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc2 Size: 483B - Virtual size: 483B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE