Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Behavioral task
behavioral1
Sample
NEAS.5c02078940de6e417fbf5d32cb7bab80.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.5c02078940de6e417fbf5d32cb7bab80.dll
Resource
win10v2004-20230915-en
Target
NEAS.5c02078940de6e417fbf5d32cb7bab80.exe
Size
160KB
MD5
5c02078940de6e417fbf5d32cb7bab80
SHA1
cf54baa582cba24d587eca6d9effb9731927868b
SHA256
3d5030184a1305e326d4f0e9ce9b4253272ee73e0342903d3f533f6162e568c3
SHA512
19e9c7133716066594548a317570383769c5ed63143d4dc87e26b217a5b40df6a490c0d31916326551efb7f5d658a4b11cd8f163bd8e421d19a8cae1afaa7736
SSDEEP
3072:Oqc1pBZFj1u9MH3fnG+w6miNZR2lQBV+UdE+rECWp7hKDVtP:nc1Jl3fG+ZBV+UdvrEFp7hKDVtP
resource | yara_rule |
---|---|
sample | upx |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
??0CContourBitmap@@QAE@XZ
??0CMemDCEx@@QAE@PAVCDC@@PBVCRect@@H@Z
??0CStaticEx@@QAE@XZ
??0CStopWatch@@QAE@XZ
??0GlobalFunc@@QAE@XZ
??1CContourBitmap@@UAE@XZ
??1CMemDCEx@@UAE@XZ
??1CStaticEx@@UAE@XZ
??1CStopWatch@@QAE@XZ
??1GlobalFunc@@QAE@XZ
??4CStopWatch@@QAEAAV0@ABV0@@Z
??4GlobalFunc@@QAEAAV0@ABV0@@Z
??BCMemDCEx@@QAEPAV0@XZ
??CCMemDCEx@@QAEPAV0@XZ
??_7CContourBitmap@@6B@
??_7CMemDCEx@@6B@
??_7CStaticEx@@6B@
?ActivateTooltip@CStaticEx@@IAEXH@Z
?Base64Decode@GlobalFunc@@CAHABV_bstr_t@@PAPAEPAH@Z
?Base64Encode@GlobalFunc@@CAHPBEHAAV_bstr_t@@@Z
?CheckCrc@GlobalFunc@@SA_NPB_W0@Z
?CheckTargetProcessIsRunningOrNot@GlobalFunc@@SA_NPB_W@Z
?CreateDirectoryTree@GlobalFunc@@SA_NPB_W_N@Z
?CreateMSXmlParser@GlobalFunc@@CAXAAV?$_com_ptr_t@V?$_com_IIID@UIXMLDOMDocument2@MSXML2@@$1?_GUID_2933bf95_7b36_11d2_b20e_00c04f983e60@@3U__s_GUID@@B@@@@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?CreateRegion@CContourBitmap@@QAEPAUHRGN__@@K@Z
?CreateRegion@CContourBitmap@@QAEPAUHRGN__@@VCPoint@@@Z
?CreateRgnFromBMPFile@GlobalFunc@@SAPAUHRGN__@@PAVCDC@@PAUHBITMAP__@@K@Z
?CreateStretchRgn@CContourBitmap@@QAEPAUHRGN__@@PAU2@MMHH@Z
?DebugAndLogPrint@GlobalFunc@@SAXPB_WZZ
?DecodingFromBase64@GlobalFunc@@SAPB_WPB_W@Z
?DecodingFromBase64ToByte@GlobalFunc@@CAPAEPB_WAAK@Z
?DecryptString@GlobalFunc@@SAPB_WPB_W@Z
?DeleteRegKey@GlobalFunc@@SAXPB_W0PAUHKEY__@@@Z
?DeleteRegValue@GlobalFunc@@SAHPB_W0PAUHKEY__@@@Z
?DeleteTargetFile@GlobalFunc@@SAXPB_W@Z
?DeleteUDPPort@GlobalFunc@@SAXPB_W@Z
?EncodingToBase64@GlobalFunc@@SAPB_WPB_W@Z
?EncodingToBase64FromByte@GlobalFunc@@CAPB_WPAEK@Z
?EncryptString@GlobalFunc@@SAPB_WPB_W@Z
?ExecuteUSBInstallProgram@GlobalFunc@@SA_NPB_W0_N@Z
?ExportCryptKey@GlobalFunc@@CAXXZ
?FUSDriverInstall@GlobalFunc@@SAKPA_W@Z
?FUSGetCompareAppVersionName@GlobalFunc@@SA_NPA_W0@Z
?FUSIsNeedUSBDriver@GlobalFunc@@SA_NPB_W@Z
?FileDecrypt@GlobalFunc@@SAJPB_W00@Z
?FileEncrypt@GlobalFunc@@SAJPB_W00@Z
?FileExist@GlobalFunc@@SA_NPB_W_N@Z
?FileNameFromFilePath@GlobalFunc@@SAPB_WPB_W@Z
?FileSize@GlobalFunc@@SA_KPB_W@Z
?FileUnZip@GlobalFunc@@SA_NPB_W0_N@Z
?FreeGlobalResource@GlobalFunc@@SAXXZ
?GenerateNonce@GlobalFunc@@SAXAAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?GenerateTempFileFullPath@GlobalFunc@@SAPB_WXZ
?GetAllRegValueNames@GlobalFunc@@SAXPB_WAAV?$list@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V?$allocator@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@std@@@std@@PAUHKEY__@@@Z
?GetCPUName@GlobalFunc@@SAPB_WXZ
?GetCommonDataFolder@GlobalFunc@@SAPB_WXZ
?GetCrc@GlobalFunc@@CA_NPB_W0@Z
?GetCurrentProgram@GlobalFunc@@SA?AW4_RUNNING_PROGRAM@@XZ
?GetCurrentRunningProcessName@GlobalFunc@@SAPB_WXZ
?GetElapsedTime@CStopWatch@@QAEMXZ
?GetFUSImageFilePath@GlobalFunc@@SAPB_WPB_W@Z
?GetFileCrc@GlobalFunc@@SAKPB_W@Z
?GetFont@CStaticEx@@QAEPAVCFont@@XZ
?GetFreeDiskSpace@GlobalFunc@@SAJXZ
?GetGlobalFont@GlobalFunc@@SAPAVCFont@@XZ
?GetGlobalFontName@GlobalFunc@@SA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W@Z
?GetIPAddress@GlobalFunc@@SAPB_WXZ
?GetKiesInstallMode@GlobalFunc@@SAHXZ
?GetLanguageLocale@GlobalFunc@@SAPB_WXZ
?GetLocalComputerName@GlobalFunc@@SAPB_WXZ
?GetMacAddress@GlobalFunc@@SAPB_WXZ
?GetMessageMap@CStaticEx@@MBEPBUAFX_MSGMAP@@XZ
?GetMotherboardInfo@GlobalFunc@@SAPB_WXZ
?GetOSLanguage@GlobalFunc@@SAPB_WXZ
?GetOSName@GlobalFunc@@SAPB_WXZ
?GetOSVersion@GlobalFunc@@SA?AW4_OS_VERSION@@XZ
?GetPhysicalDiskSerialNumber@GlobalFunc@@SAPB_WXZ
?GetPhysicalRAMSize@GlobalFunc@@SAPB_WXZ
?GetRegString@GlobalFunc@@SAHPAUHKEY__@@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@1AAV34@@Z
?GetRegValue@GlobalFunc@@CAHPAUHKEY__@@PB_W1AAK@Z
?GetRegValue@GlobalFunc@@CAHPAUHKEY__@@PB_W1AAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?GetSize@CContourBitmap@@QAE?AVCSize@@XZ
?GetString@CStaticEx@@QAEXAAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?GetStringFromBasicResource@GlobalFunc@@SA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W@Z
?GetStringFromResource@GlobalFunc@@SA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W@Z
?GetSubKeyNames@GlobalFunc@@SAXPB_WAAV?$list@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V?$allocator@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@std@@@std@@PAUHKEY__@@@Z
?GetSymmetrickey@GlobalFunc@@SA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WAAV23@@Z
?GetTargetDllVersion@GlobalFunc@@SAPB_WPB_W@Z
?GetThisMessageMap@CStaticEx@@KGPBUAFX_MSGMAP@@XZ
?GetUSBHostHWID@GlobalFunc@@SAPB_WXZ
?GetUSBHostName@GlobalFunc@@SAPB_WXZ
?GetUserTempFolder@GlobalFunc@@SAPB_WXZ
?GetWlanList@GlobalFunc@@CAHAAV?$vector@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V?$allocator@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@std@@@std@@@Z
?ImportCryptKey@GlobalFunc@@CAXXZ
?InitToolTip@CStaticEx@@IAEXXZ
?InitializeDebugAndLogPrint@GlobalFunc@@CAXPB_W@Z
?InternalCreateRegion@CContourBitmap@@AAEPAUHRGN__@@PAVCDC@@K@Z
?Is64BitOS@GlobalFunc@@SAHXZ
?IsAvailableIPv4@GlobalFunc@@SAHPA_W@Z
?IsRTL@GlobalFunc@@SAHXZ
?IsRunning@CStopWatch@@QAE_NXZ
?IsWow64@GlobalFunc@@SAHXZ
?LoadBaseLanguageResource@GlobalFunc@@CAX_N@Z
?LoadCPUName@GlobalFunc@@CAHXZ
?LoadHardwareInformation@GlobalFunc@@CAHXZ
?LoadLanguageResource@GlobalFunc@@SAXPB_W_N@Z
?LoadNetworkInformation@GlobalFunc@@CAHAAV?$vector@U_PC_NETWORKINFO@@V?$allocator@U_PC_NETWORKINFO@@@std@@@std@@@Z
?LoadNetworkInformation@GlobalFunc@@CAHXZ
?LoadOSInformation@GlobalFunc@@CAHXZ
?LoadOSLanguage@GlobalFunc@@CAHXZ
?LoadOSVersion@GlobalFunc@@CAHXZ
?LoadPNGImage2@GlobalFunc@@SAPAVBitmap@Gdiplus@@PAUHINSTANCE__@@I@Z
?LoadPNGImage@GlobalFunc@@SAPAVBitmap@Gdiplus@@PAUHINSTANCE__@@I@Z
?LoadUSBController@GlobalFunc@@CAHXZ
?OnEraseBkgnd@CStaticEx@@IAEHPAVCDC@@@Z
?OnPaint@CStaticEx@@IAEXXZ
?OnSetCursor@CStaticEx@@QAEHPAVCWnd@@II@Z
?OnSize@CStaticEx@@QAEXIHH@Z
?Paint@CContourBitmap@@QAEHPAVCDC@@HH@Z
?PreTranslateMessage@CStaticEx@@MAEHPAUtagMSG@@@Z
?ReadCryptReg@GlobalFunc@@SAPB_WPB_W0PAUHKEY__@@@Z
?ReadDWORDValue@GlobalFunc@@SAKPB_W0KPAUHKEY__@@@Z
?ReadKeyAndIVFromManageCode@GlobalFunc@@SA_NXZ
?ReadStringValue@GlobalFunc@@SAPB_WPB_W00PAUHKEY__@@@Z
?ReadUDPPortFromRegistry@GlobalFunc@@SAKPB_WH@Z
?ReleasePNGImages2@GlobalFunc@@SAXXZ
?SetBoldFont@CStaticEx@@QAEXH@Z
?SetColor@CStaticEx@@QAEXKK@Z
?SetCurrentProgram@GlobalFunc@@SAXW4_RUNNING_PROGRAM@@@Z
?SetCurrentRunningProcessName@GlobalFunc@@SAXPB_W@Z
?SetCurstomCursor@CStaticEx@@QAEXPAUHICON__@@@Z
?SetFont@CStaticEx@@QAEXAAUtagLOGFONTW@@@Z
?SetFontSize@CStaticEx@@QAEXH@Z
?SetGlobalFont@GlobalFunc@@SAXPB_W@Z
?SetPasswordEnable@CStaticEx@@QAEXH@Z
?SetRTL@CStaticEx@@QAEXH@Z
?SetRegValue@GlobalFunc@@CAHPAUHKEY__@@PB_W11@Z
?SetRegValue@GlobalFunc@@CAHPAUHKEY__@@PB_W1K@Z
?SetString@CStaticEx@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@W4_ALIGN_POS@@@Z
?SetToolTipText@CStaticEx@@QAEXPB_WH@Z
?SetToolTipText@CStaticEx@@QAEXPB_WPAVCFont@@H@Z
?ShowErrorMessage@GlobalFunc@@SAPB_WK@Z
?SinglePaint@CContourBitmap@@QAEHPAVCDC@@HHHHHH@Z
?Start@CStopWatch@@QAEXXZ
?StretchPaint@CContourBitmap@@QAEHPAVCDC@@HHHH@Z
?TransparentPaint@CContourBitmap@@QAEHPAVCDC@@HHHHHHHHI@Z
?USBDriverReinstall@GlobalFunc@@SA_NXZ
?UTF8ToUnicode@GlobalFunc@@SAPA_WPADPAH@Z
?Unicode2UTF8@GlobalFunc@@SAPADPB_WPAH@Z
?WaitingForUSBInstaller@GlobalFunc@@SAXXZ
?WriteCryptReg@GlobalFunc@@SAHPB_W00PAUHKEY__@@@Z
?WriteDWORDValue@GlobalFunc@@SAHPB_W0KPAUHKEY__@@@Z
?WriteStringValue@GlobalFunc@@SAHPB_W00PAUHKEY__@@@Z
?WriteUDPPortToRegistry@GlobalFunc@@SAXIPB_W@Z
?encryptMD5@GlobalFunc@@SAJV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PAEAAV23@@Z
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE