NEAS[.]5fb11c642a6049b06f79ff2c40a1a870[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.5fb11c642a6049b06f79ff2c40a1a870.exe
Size

86KB
MD5

5fb11c642a6049b06f79ff2c40a1a870
SHA1

614b5ba30c53bba4b0e1e326868a2e8d1c4c58f1
SHA256

f9dbd13068f9c0cf3c2526599813c46119bcb633a192820eec87f35561a83700
SHA512

2a1c664e5233bf2b6f899ea1f6b298c4eeefe80cae7d715261dda201c77b36ea21231e594632bccbf0eea8244175b723e8a4a16ad0b3bb2f7a2b0e7620b8440d
SSDEEP

1536:ye1T/Y7ygiN1CS4fkkWyowBwWDvtKMPtG4XyytAgN:zY23N1wfGoKM1G4XD5N

Score

1^/10

Malware Config

Signatures

Files

NEAS.5fb11c642a6049b06f79ff2c40a1a870.exe
.dll windows:4 windows x86

6adf3c7cdebf6a5ac26db35caa52b770

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:70:5a:9d:e0:e2:78:d0:fd:4b:4c:0a:00:18:92:a2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

19/03/2013, 00:00

Not After

19/03/2015, 23:59

Subject

CN=天一星辰（北京）科技有限公司,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=FC,O=天一星辰（北京）科技有限公司,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ba:51:08:b9:b3:01:6a:7c:42:51:14:d9:35:6b:33:4c:37:0f:e7:36
Signer

Actual PE Digest

ba:51:08:b9:b3:01:6a:7c:42:51:14:d9:35:6b:33:4c:37:0f:e7:36

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord825
ord815
ord823
ord6467
ord3953
ord860
ord3663
ord800
ord540
ord2841
ord858
ord924
ord5572
ord2915
ord537
ord2864
ord2107
ord6215
ord5860
ord6142
ord5450
ord5440
ord6383
ord6394
ord6055
ord4078
ord1776
ord4407
ord2385
ord5163
ord6374
ord4353
ord5290
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord4627
ord3742
ord567
ord818
ord4275
ord6442
ord3626
ord755
ord2414
ord3831
ord4297
ord5788
ord472
ord2754
ord470
ord2379
ord6453
ord4299
ord2859
ord283
ord2818
ord2860
ord5787
ord5241
ord5875
ord535
ord772
ord500
ord2971
ord5759
ord6192
ord5756
ord6186
ord4330
ord6189
ord6172
ord5873
ord5789
ord5794
ord5678
ord5736
ord5579
ord5571
ord6061
ord5864
ord3596
ord3571
ord640
ord5785
ord6194
ord6021
ord1641
ord1640
ord323
ord6877
ord6880
ord2567
ord1176
ord1575
ord1168
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord1578
ord600
ord826
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3147
ord3259
ord269
ord2982
ord5714
ord5289
ord5307
ord4698
ord4079
ord2725
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4133
ord4274
ord1116

msvcrt

_purecall
_ftol
_snprintf
qsort
memmove
__dllonexit
_onexit
free
_initterm
malloc
_adjust_fdiv
??1type_info@@UAE@XZ
__CxxFrameHandler

kernel32

LocalFree
lstrcpynA
lstrcmpA
lstrlenA
lstrcpyA
CreateDirectoryA
LocalAlloc

user32

LoadCursorA
SetCursor
SetCapture
GetMessageA
GetCapture
DispatchMessageA
SetRect
GetClientRect
RegisterWindowMessageA
GetParent
BringWindowToTop
LoadImageA
DestroyIcon
LoadStringA
PostMessageA
InvalidateRect
EnableWindow
CopyRect
IsWindowVisible
FillRect
DrawTextA
GrayStringA
TabbedTextOutA
GetWindowRect
IsWindow
SendMessageA
ReleaseCapture
PtInRect

gdi32

SetTextColor
SetBkMode
LineTo
MoveToEx
GetTextExtentPoint32A
SetPixelV
Rectangle
BitBlt
GetBkColor
DPtoLP
GetMapMode
CreateCompatibleBitmap
LPtoDP
CreateCompatibleDC
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject

Exports

Exports

DllGetPluginObject

Sections

.text
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6adf3c7cdebf6a5ac26db35caa52b770

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

07:70:5a:9d:e0:e2:78:d0:fd:4b:4c:0a:00:18:92:a2Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

ba:51:08:b9:b3:01:6a:7c:42:51:14:d9:35:6b:33:4c:37:0f:e7:36Signer

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

gdi32

Exports

Exports

Sections

.text Size: 48KB - Virtual size: 45KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 6KB

.rsrc Size: 12KB - Virtual size: 8KB

.reloc Size: 4KB - Virtual size: 3KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

07:70:5a:9d:e0:e2:78:d0:fd:4b:4c:0a:00:18:92:a2
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

ba:51:08:b9:b3:01:6a:7c:42:51:14:d9:35:6b:33:4c:37:0f:e7:36
Signer

.text
Size: 48KB - Virtual size: 45KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 12KB - Virtual size: 8KB

.reloc
Size: 4KB - Virtual size: 3KB