NEAS[.]0c84679585e362e438ea74ba6d6a4320_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.0c84679585e362e438ea74ba6d6a4320_JC.exe
Size

67KB
MD5

0c84679585e362e438ea74ba6d6a4320
SHA1

801aad24bff2a7b4adca86fee3a2797f59885797
SHA256

0dc85089e4d1b9d14ff119d78a6edfb5b73c835cbc2ed2984801314aefc9e463
SHA512

3845421d8dd8053859d4dc75924c2a378ac42e99f94adb722a5d0b577e7638297042e2e9011df4b8b43158bca4f7fb69e165a242dc7a42b686887f6b5f46ca90
SSDEEP

1536:qkj2bXTaxCdisKldR7eUjFsPjbn5as0IGamSz:qkj2bGpV7ePPHn5avPfS

Score

1^/10

Malware Config

Signatures

Files

NEAS.0c84679585e362e438ea74ba6d6a4320_JC.exe
.exe windows:4 windows x86

3af4fdd9f52b647a3d5abccd8fd74437

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:16:5e:50:24:9f:f6:ad:03:9d:77:06:ec:59:bf:8d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

31/07/2009, 00:00

Not After

30/07/2012, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing) Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileW
lstrcatW
FindFirstFileW
lstrcpyW
RemoveDirectoryW
CreateProcessW
SetCurrentDirectoryW
CopyFileW
GetTempPathW
GetModuleFileNameW
FreeLibrary
GetProcAddress
LoadLibraryW
GetCurrentDirectoryW
lstrlenW
CreateFileW
CloseHandle
WaitForSingleObject
Sleep
GetLastError
FindNextFileW
TerminateProcess
InterlockedDecrement
InterlockedIncrement
VirtualFree
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
GetFileAttributesW
SetErrorMode
VirtualAlloc
GetSystemInfo
SetEvent
IsBadReadPtr
GetModuleHandleW
FindClose
MoveFileExW
GetThreadLocale
CreateEventW
LCMapStringW
GetStartupInfoW

user32

RegisterWindowMessageW
wsprintfW
DestroyIcon
DefWindowProcW
DialogBoxParamW
GetActiveWindow
SendMessageW
GetWindowLongW
GetParent
GetWindow
GetWindowRect
SystemParametersInfoW
GetClientRect
MapWindowPoints
SetWindowPos
SetWindowLongW
GetDlgItem
MessageBoxW
LoadIconW
SetClassLongW
CheckDlgButton
SetDlgItemTextW
SetWindowTextW
IsDlgButtonChecked
EndDialog
FindWindowExW
IsWindow

advapi32

RegDeleteKeyW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey

shell32

ShellExecuteW
SHGetSpecialFolderPathW

ole32

CoUninitialize
CoInitialize

wininet

InternetCrackUrlW
InternetConnectW
HttpOpenRequestW
InternetCloseHandle
InternetOpenW
InternetSetStatusCallbackW
HttpSendRequestW

msvcrt

_controlfp
exit
_XcptFilter
_exit
_onexit
__dllonexit
wcschr
wcscpy
memset
_except_handler3
vswprintf
??3@YAXPAX@Z
malloc
realloc
free
memcpy
wcslen
wcsncpy
wcscat
wcsrchr
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_wcmdln

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 47KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

xmdofdt
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3af4fdd9f52b647a3d5abccd8fd74437

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

65:16:5e:50:24:9f:f6:ad:03:9d:77:06:ec:59:bf:8dCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

wininet

msvcrt

Sections

.text Size: 10KB - Virtual size: 9KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 5KB - Virtual size: 4KB

.rsrc Size: 47KB - Virtual size: 48KB

xmdofdt Size: - Virtual size: 4KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

65:16:5e:50:24:9f:f6:ad:03:9d:77:06:ec:59:bf:8d
Certificate

.text
Size: 10KB - Virtual size: 9KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 47KB - Virtual size: 48KB

xmdofdt
Size: - Virtual size: 4KB