Static task
static1
Behavioral task
behavioral1
Sample
NEAS.05af1c4df2ad7d3e9b0239d9fd7c4920_JC.dll
Resource
win7-20231020-en
General
-
Target
NEAS.05af1c4df2ad7d3e9b0239d9fd7c4920_JC.exe
-
Size
487KB
-
MD5
05af1c4df2ad7d3e9b0239d9fd7c4920
-
SHA1
e6a47e88d2429425b2f2aa3f398404555b3eb680
-
SHA256
3a308672963334b663d458682f7d60a18113b0c8b30bd5ff61a5619798a49356
-
SHA512
147a4f2f9c9610d8ce9a45481dfca0a0e531e787718d4a5f8efdb430ceea501e79f262d9667847c8080fa4b713d29d637a1027b1d0f7627ca554133705b049ef
-
SSDEEP
6144:JgKhaMbJwWkSHD8ffRTWXnrHwBybEwHhA4kP6X4/TpifC:JlhHg1WXr9BAvP6XXfC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.05af1c4df2ad7d3e9b0239d9fd7c4920_JC.exe
Files
-
NEAS.05af1c4df2ad7d3e9b0239d9fd7c4920_JC.exe.dll windows:6 windows x86
bc469a4412ecab9e01ae8d74c1defeca
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
UnmapViewOfFile
EnumCalendarInfoW
GetUserDefaultLangID
LoadLibraryW
LeaveCriticalSection
TerminateProcess
GetCPInfoExW
GetThreadLocale
ExitThread
VirtualProtect
MapViewOfFile
FreeLibrary
GetUserDefaultLCID
GetLogicalDrives
GetCurrentThread
GetWindowsDirectoryA
SizeofResource
CreateFileW
ReadConsoleW
WriteConsoleW
SetStdHandle
OutputDebugStringW
LoadLibraryExW
HeapReAlloc
SetFilePointerEx
ReadFile
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetLocaleInfoA
WriteFile
GetOEMCP
GetACP
FreeEnvironmentStringsW
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleFileNameA
GetFileType
GetStdHandle
HeapSize
GetModuleHandleExW
GetProcessHeap
IsDebuggerPresent
EnumSystemLocalesW
LCMapStringW
GetProcAddress
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCurrentProcess
Sleep
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetTempFileNameW
GetSystemDefaultLangID
GetStartupInfoW
GetDateFormatW
CreateThread
GetCurrentProcessId
GetWindowsDirectoryW
CloseHandle
FindNextFileA
DeviceIoControl
GetDiskFreeSpaceW
IsValidCodePage
GetTempPathW
GlobalUnlock
MulDiv
GetLocaleInfoW
SetCommTimeouts
ClearCommBreak
GetCommState
FindFirstFileW
ExitProcess
QueryDosDeviceW
GetPrivateProfileIntW
IsValidLocale
GetEnvironmentStringsW
SetDllDirectoryW
GetFullPathNameW
EnterCriticalSection
RemoveDirectoryW
ResetEvent
GlobalFree
InitializeCriticalSectionAndSpinCount
GetTickCount
RtlCaptureContext
GetModuleFileNameW
HeapAlloc
RtlUnwind
RaiseException
GetCPInfo
GetCurrentThreadId
GetCommandLineA
HeapFree
GetLastError
WideCharToMultiByte
EncodePointer
DecodePointer
DeleteCriticalSection
MultiByteToWideChar
GetStringTypeW
user32
GetSubMenu
RemovePropA
SetPropA
PostMessageA
TranslateMDISysAccel
CharUpperBuffW
CreateCaret
GetWindowPlacement
InvalidateRect
SetScrollPos
EnableScrollBar
MapWindowPoints
DestroyIcon
EndPaint
ClientToScreen
MapDialogRect
InflateRect
SetKeyboardState
SetParent
GetClientRect
ModifyMenuW
CreateIconIndirect
GetKeyboardLayout
GetDlgItem
CreatePopupMenu
GetSysColorBrush
IsDlgButtonChecked
AppendMenuA
IsWindow
MessageBoxW
BeginDeferWindowPos
GetDlgItemTextW
SendMessageW
LoadCursorA
GetWindowThreadProcessId
DeleteMenu
MessageBeep
GetMenuStringW
GetKeyboardState
MessageBoxA
ScrollWindow
ValidateRgn
DestroyMenu
IsIconic
gdi32
GetDeviceCaps
GetRgnBox
PolyPolyline
DeleteObject
PlayEnhMetaFile
StretchDIBits
SetViewportExtEx
RestoreDC
SetLayout
TranslateCharsetInfo
GetWindowOrgEx
ExtFloodFill
SetTextColor
MaskBlt
DeleteDC
CreateFontIndirectW
RealizePalette
GetObjectW
CreateSolidBrush
SetStretchBltMode
Polyline
SetTextAlign
EndDoc
comdlg32
FindTextW
advapi32
RegDeleteKeyA
OpenSCManagerW
AllocateAndInitializeSid
ChangeServiceConfigW
OpenProcessToken
LookupPrivilegeValueW
OpenServiceW
shell32
ShellExecuteW
ExtractIconExW
oleaut32
VariantCopy
SysFreeString
SafeArrayPtrOfIndex
VariantInit
VariantClear
Sections
.text Size: 371KB - Virtual size: 371KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 79KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ