NEAS[.]9c4f08c5d187e97d27c1026ee48f2520_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.9c4f08c5d187e97d27c1026ee48f2520_JC.exe
Size

119KB
MD5

9c4f08c5d187e97d27c1026ee48f2520
SHA1

cb0c357da7b9618916889cc077975badcc37255e
SHA256

bbf9f7460f47bf0470ad6559482728e147d5307acea56eb985ba8bf1b774203f
SHA512

f8f2bd6a090ded7b23fc9c341544a8c4983b46e89c5cc5e1b6902f05633de8dabf063ebde41ebf964a89ff751e1f2fc7e8b01418293080ee74f6ffa4222b5d7b
SSDEEP

3072:f2UBH6ywwjVzDuOBhaRwkGhfDEgeda3dQwd1S2NUL:+y9jUOH6zFa3CwTS2Nq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.9c4f08c5d187e97d27c1026ee48f2520_JC.exe

Files

NEAS.9c4f08c5d187e97d27c1026ee48f2520_JC.exe
.exe windows:4 windows x86

07d0cfe80eb953b2794febb7b391642e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

QuirkIsEnabled2Worker
GetProcessPreferredUILanguages
IsProcessorFeaturePresent
BasepInitAppCompatData
ShowConsoleCursor
ResetWriteWatch
CreateProcessAsUserW
EnumSystemFirmwareTables
AddConsoleAliasA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE