NEAS[.]b818bd4e24d646163637a48bdd9fd100_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.b818bd4e24d646163637a48bdd9fd100_JC.exe
Size

92KB
MD5

b818bd4e24d646163637a48bdd9fd100
SHA1

70bb439d844f36de9923c73070f62c71866ab45e
SHA256

f76dd63f51356d336bb6503136004bf3684404531404ca26960fdf88fd1502d6
SHA512

7438423140a6af64abf65cee846d5fd0df01e98755a06d1dadb744c3073f4e226ac6082377761c55a670f21f4829a37fe7585707a01bd96bee74cd49cfbe732c
SSDEEP

1536:umi+ty2/k5BCt4xmXMXo+bjeJc187ZdC0uwPBRfrYYh9Kd5N3U2:ZY2g3mXMXvBYjuxYhkV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.b818bd4e24d646163637a48bdd9fd100_JC.exe

Files

NEAS.b818bd4e24d646163637a48bdd9fd100_JC.exe
.exe windows:4 windows x86

4d608a2d8e91bcdde7dcaa39716ad95f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAStartup
gethostname

kernel32

GetLastError
GetStdHandle
SetConsoleMode
LocalFree
FormatMessageA
ReadFile
GetConsoleMode

libsasl

getopt
optarg
optind
sasl_version
sasl_server_init
sasl_server_new
sasl_setpass
prop_new
prop_request
prop_set
sasl_auxprop_store
prop_dispose
sasl_dispose
sasl_done
sasl_errstring

msvcrt

strchr
_strdup
exit
_onexit
__dllonexit
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
_XcptFilter
_exit
fflush
fprintf
_iob
perror
malloc
putchar
fputs
strrchr

Sections

.text
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE