NEAS[.]d61241691d764a524c5fc4abb29049d0_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.d61241691d764a524c5fc4abb29049d0_JC.exe
Size

321KB
MD5

d61241691d764a524c5fc4abb29049d0
SHA1

8bab6b5fe6c038ebc485471cd5b8921b947e082a
SHA256

b8f44001e0ebd1df293c0835388f99b47f09ea39fccdc266d19606fce90d008d
SHA512

233dd58387ea05c84cab02f6524b9d8274c988be211bddb0fd6cb8b4fc515bc66fef5748aa1115106df49ea1829c6ef55dcd87b736304a348faca85e3f08a68b
SSDEEP

6144:Y1thznQC4hEgB/w2KBi+sQRZ66z+n4VZbd8g79pgrXNgRnVLjyzhbkidNN2T:Y1DzneEm9KOQRZ66z24VZbdrpgrXN2LZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.d61241691d764a524c5fc4abb29049d0_JC.exe

Files

NEAS.d61241691d764a524c5fc4abb29049d0_JC.exe
.exe windows:10 windows x86

c6e1b8202aded47b7c2380a87886d20c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegOpenKeyW
RegDeleteValueW
RegCreateKeyW
RegGetValueW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegEnumKeyW
RegLoadKeyW
RegUnLoadKeyW
RegDeleteKeyW
RegQueryInfoKeyW
RegRenameKey
GetSecurityInfo
RegQueryValueExW
OpenProcessToken
RegSetKeySecurity
GetSecurityDescriptorControl
AdjustTokenPrivileges
LookupPrivilegeValueW
RegConnectRegistryW
RegEnumValueW
SetSecurityDescriptorGroup
LookupAccountSidW
MapGenericMask
SetSecurityInfo
InitializeAcl
InitializeSecurityDescriptor
IsValidSecurityDescriptor
SetSecurityDescriptorSacl
GetSecurityDescriptorOwner
GetNamedSecurityInfoW
SetNamedSecurityInfoW
RegFlushKey
GetSidSubAuthority
GetSecurityDescriptorGroup
GetSidSubAuthorityCount
SetSecurityDescriptorOwner
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
RegSetValueW
RegRestoreKeyW
RegSetValueExA
RegSaveKeyW
GetInheritanceSourceW
RegCloseKey

kernel32

GetModuleHandleExW
FreeLibrary
GetTimeFormatW
FileTimeToLocalFileTime
LoadLibraryW
FileTimeToSystemTime
lstrcmpW
WideCharToMultiByte
GetFileSize
DeleteFileW
MultiByteToWideChar
CreateFileW
SetFilePointer
WriteFile
SearchPathW
ReadFile
GetCurrentProcess
ExitProcess
HeapSetInformation
GetLongPathNameW
GetCommandLineW
lstrcmpiW
LocalAlloc
IsDebuggerPresent
RegisterApplicationRestart
GetDateFormatW
GlobalAlloc
GetProcAddress
GlobalLock
GetModuleHandleW
LocalReAlloc
DebugBreak
GlobalUnlock
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
CompareStringOrdinal
WaitForSingleObject
MulDiv
GetProcessHeap
GetCurrentProcessId
GetComputerNameW
LocalFree
CreateMutexExW
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
HeapAlloc
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
Sleep
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
ResolveDelayLoadedAPI
DelayLoadFailureHook
GetModuleFileNameA

gdi32

GetStockObject
GetTextExtentPoint32W
StartPage
AbortDoc
EndDoc
DeleteDC
SetViewportOrgEx
SetAbortProc
StartDocW
EndPage
CreatePatternBrush
CreateBitmap
PatBlt
SelectClipRgn
GetObjectW
ExcludeClipRect
SelectObject
GetDeviceCaps
GetTextMetricsW
SetTextColor
SetBkColor
DeleteObject
CreateFontIndirectW
ExtTextOutW

user32

IsIconic
GetDpiForSystem
LoadMenuW
LoadImageW
UpdateWindow
DialogBoxParamW
PostQuitMessage
CheckMenuItem
GetSystemMetricsForDpi
SetCursor
InsertMenuW
EndDeferWindowPos
DrawMenuBar
GetProcessDefaultLayout
LoadIconW
TranslateMessage
TranslateAcceleratorW
GetSysColor
SetThreadDpiAwarenessContext
SetMenuDefaultItem
SetWindowPlacement
SetMenuItemInfoW
ClientToScreen
DestroyIcon
DispatchMessageW
BeginDeferWindowPos
ShowWindow
LoadStringW
LoadAcceleratorsW
GetWindowPlacement
RegisterClassExW
SetWindowTextW
ScreenToClient
DeleteMenu
CreateWindowExW
GetDpiForWindow
InsertMenuItemW
GetMenu
GetMenuItemID
PostMessageW
GetMenuItemInfoW
DeferWindowPos
GetMessageW
GetClientRect
CharNextW
SetCursorPos
CreateDialogParamW
CheckDlgButton
IntersectRect
GetMessagePos
ModifyMenuW
DrawAnimatedRects
SetForegroundWindow
FindWindowW
BringWindowToTop
GetLastActivePopup
PeekMessageW
IsDialogMessageW
GetWindow
CharUpperBuffW
IsCharAlphaNumericW
CharUpperW
GetWindowRect
GetDC
SetWindowPos
HideCaret
EndDialog
GetSystemMetrics
MessageBeep
SetCaretPos
GetSubMenu
OpenClipboard
SetTimer
CloseClipboard
EmptyClipboard
CreateCaret
SetDlgItemTextW
MapWindowPoints
SendDlgItemMessageW
MoveWindow
DestroyMenu
EnableWindow
GetWindowTextLengthW
CallWindowProcW
GetDlgItemInt
CheckRadioButton
SendMessageW
GetDlgItemTextW
IsDlgButtonChecked
SetFocus
GetClipboardData
ScrollWindowEx
LoadCursorW
DestroyCaret
SetCapture
SetClipboardData
SetWindowLongW
TrackPopupMenuEx
GetDlgItem
GetParent
GetWindowTextW
GetWindowLongW
SetScrollInfo
RegisterClipboardFormatW
DefWindowProcW
GetKeyState
DestroyWindow
IsClipboardFormatAvailable
ShowCaret
KillTimer
EnableMenuItem
ReleaseCapture
InvalidateRect
ReleaseDC
BeginPaint
EndPaint
CharLowerW
ShowCursor
RegisterClassW

msvcrt

_unlock
_lock
__CxxFrameHandler3
_acmdln
_initterm
__setusermatherr
_ismbblead
__p__fmode
_cexit
_exit
exit
__set_app_type
__getmainargs
_onexit
__p__commode
_XcptFilter
iswprint
memcpy
_except_handler4_common
_vsnwprintf
atoi
memcpy_s
_purecall
wcschr
isspace
_wcsnicmp
wcsrchr
wcsncmp
_resetstkoflw
?terminate@@YAXXZ
_controlfp
memset
__dllonexit
memmove
_amsg_exit

api-ms-win-core-path-l1-1-0

PathCchAddBackslash
PathCchCombine

shlwapi

StrChrW
StrRChrW
ord388
ord219
StrToIntW
StrChrIW
StrStrIW

comctl32

ImageList_ReplaceIcon
ord410
ord413
ImageList_SetBkColor
ord337
ord236
InitCommonControlsEx
ord384
ImageList_Create
ord4
ImageList_Destroy
ord340
ord2
ord329
ord334
ord338

comdlg32

GetOpenFileNameW
GetSaveFileNameW
ChooseFontW
PrintDlgExW

shell32

DragFinish
DragQueryFileW
SHGetStockIconInfo
ord6
ShellAboutW

authz

AuthzInitializeContextFromSid
AuthzFreeContext
AuthzFreeResourceManager
AuthzAccessCheck
AuthzInitializeResourceManager

aclui

ord2

ole32

CoTaskMemFree
CoInitializeEx
ReleaseStgMedium
CoUninitialize
CoCreateInstance
CoTaskMemAlloc

ulib

?SPrintfAppend@DSTRING@@UAAEPBGZZ
?NewBuf@DSTRING@@UAEEK@Z
?Resize@DSTRING@@UAEEK@Z
?Initialize@WSTRING@@QAEEPBGK@Z
?Initialize@WSTRING@@QAEEPBV1@KK@Z
?Strcat@WSTRING@@QAEEPBV1@@Z
??0DSTRING@@QAE@XZ
??1DSTRING@@UAE@XZ
?SPrintf@DSTRING@@UAAEPBGZZ
?Compare@OBJECT@@UBEJPBV1@@Z
??1OBJECT@@UAE@XZ
?Initialize@ARRAY@@QAEEKK@Z
??0OBJECT@@IAE@XZ
??0ARRAY@@QAE@XZ
?DebugDump@OBJECT@@UBEXE@Z

clb

ClbSetColumnWidths
ClbAddData

ntdll

RtlFreeHeap
RtlAllocateHeap
RtlCreateUnicodeString
RtlInitUnicodeString
RtlFreeUnicodeString
RtlIoDecodeMemIoResource
RtlCmDecodeMemIoResource

uxtheme

SetWindowTheme

Sections

.text
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 187KB - Virtual size: 186KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c6e1b8202aded47b7c2380a87886d20c

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

api-ms-win-core-path-l1-1-0

shlwapi

comctl32

comdlg32

shell32

authz

aclui

ole32

ulib

clb

ntdll

uxtheme

Sections

.text Size: 113KB - Virtual size: 113KB

.data Size: 512B - Virtual size: 264KB

.idata Size: 10KB - Virtual size: 9KB

.didat Size: 512B - Virtual size: 8B

.rsrc Size: 187KB - Virtual size: 186KB

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 113KB - Virtual size: 113KB

.data
Size: 512B - Virtual size: 264KB

.idata
Size: 10KB - Virtual size: 9KB

.didat
Size: 512B - Virtual size: 8B

.rsrc
Size: 187KB - Virtual size: 186KB

.reloc
Size: 9KB - Virtual size: 8KB