NEAS[.]21cedca13669dddbe0552af70b9d9840[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.21cedca13669dddbe0552af70b9d9840.exe
Size

398KB
MD5

21cedca13669dddbe0552af70b9d9840
SHA1

84f59a82853b8c972d2680945fe1489aedabf4ee
SHA256

10b0d469d49a6e5a2f7a91f1365416962797594b4920fd9e747bb3004252de4c
SHA512

0d701428777fb6fbdfb4f578c2d011e9f69064b7cd9aba72086d7736e00c75c81e307100b6e91f6bbe2c66a1bebb5378b95705eb5afb9df22be261e136adf90b
SSDEEP

6144:/OaaH7HcBsch2Fev2iHJdQgT3Kr/6ZHRRltv3J4/mTPMJjnqYx:/obHejh2Fev2iHJfzKrqxRllGiej

Score

1^/10

Malware Config

Signatures

Files

NEAS.21cedca13669dddbe0552af70b9d9840.exe
.exe windows:4 windows x86

faa4a507e31e9c82c2b6fae4fe9e7928

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

65:e5:ac:ba:40:b7:1e:70:c2:b5:5c:23:e5:48:2f:82:8c:7a:c5:2b
Signer

Actual PE Digest

65:e5:ac:ba:40:b7:1e:70:c2:b5:5c:23:e5:48:2f:82:8c:7a:c5:2b

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

psapi

EnumProcesses
EnumProcessModules
GetModuleBaseNameW

msimg32

TransparentBlt

msvcrt

wcslen
wcscmp
_vsnwprintf
memmove
_wtoi
wcschr
_wcsicmp
wcsstr
_snwprintf
swscanf
__CxxFrameHandler
memcpy
_wcsdup
_endthreadex
_beginthreadex
memset
_CxxThrowException
malloc
_except_handler3
realloc
labs
free
_expand
_msize
wcstoul
wcstol
iswdigit
iswspace
_ultow
_ltow
wcscpy
wcsncpy
_c_exit
_exit
_XcptFilter
_controlfp
??1type_info@@UAE@XZ
ctime
mktime
gmtime
localtime
time
?terminate@@YAXXZ
_vsnprintf
_onexit
__dllonexit
__set_app_type
_cexit
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_amsg_exit
_wcmdln
exit
__p__fmode

kernel32

FreeLibrary
GlobalAlloc
lstrcmpW
GlobalLock
WideCharToMultiByte
MultiByteToWideChar
GetCurrentThreadId
GetCurrentThread
lstrlenW
GlobalAddAtomW
SetThreadPriority
ResumeThread
GlobalDeleteAtom
SuspendThread
CreateEventW
lstrcpynW
SetLastError
LoadLibraryA
GetModuleHandleA
GetFileAttributesW
VirtualProtect
OutputDebugStringA
GlobalFree
GlobalUnlock
LocalFree
FormatMessageW
GetVersionExA
lstrcatW
lstrlenA
GlobalFindAtomW
InterlockedDecrement
RaiseException
InitializeCriticalSection
DeleteCriticalSection
WritePrivateProfileStringW
lstrcmpiW
InterlockedIncrement
GlobalFlags
LocalAlloc
LeaveCriticalSection
GlobalReAlloc
GlobalHandle
EnterCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
GetCurrentProcess
FindClose
FindFirstFileW
GetVolumeInformationW
GetFullPathNameW
CreateFileW
FindResourceExW
FileTimeToSystemTime
SetErrorMode
FileTimeToLocalFileTime
GetFileTime
GetTickCount
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
GetSystemInfo
VirtualQuery
LoadLibraryExW
GetSystemDirectoryW
FormatMessageA
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
ConvertDefaultLocale
GetVersion
EnumResourceLanguagesW
lstrcpyW
LoadLibraryW
OpenProcess
WaitForSingleObject
CloseHandle
CreateProcessW
GetUserDefaultUILanguage
IsValidLocale
GetLocaleInfoW
FreeResource
SizeofResource
MulDiv
FindResourceW
LoadResource
LockResource
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
CreateMutexW
GetLastError
ReleaseMutex
SetEvent

user32

SetCapture
InvalidateRgn
CopyAcceleratorTableW
SetRect
IsRectEmpty
CharNextW
CharUpperW
LoadCursorW
GetSysColorBrush
wsprintfW
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
MoveWindow
SetWindowTextW
IsDialogMessageW
RegisterWindowMessageW
WinHelpW
GetClassLongW
SetPropW
GetPropW
RemovePropW
SendDlgItemMessageW
SendDlgItemMessageA
IsChild
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
GetClassInfoW
ReleaseCapture
MessageBoxW
CreateWindowExW
GetClassInfoExW
UnregisterClassW
RegisterClassW
GetMenu
AdjustWindowRectEx
ScreenToClient
EqualRect
GetScrollInfo
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
CopyRect
PtInRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetMenuItemID
GetMenuItemCount
GetSubMenu
DestroyWindow
IsWindow
CreateDialogIndirectParamW
EndDialog
SetWindowContextHelpId
MapDialogRect
SetWindowPos
ShowWindow
GetAsyncKeyState
SetFocus
GetDlgItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
MessageBoxA
PostThreadMessageW
SetWindowsHookExW
CallNextHookEx
GetMessageW
RegisterClipboardFormatW
DestroyMenu
GetNextDlgGroupItem
TranslateMessage
DispatchMessageW
IsWindowVisible
GetKeyState
GetCursorPos
ValidateRect
SetCursor
PostQuitMessage
GetDesktopWindow
GetWindowThreadProcessId
GetClassNameW
SendMessageTimeoutW
SetForegroundWindow
PostMessageW
OffsetRect
SystemParametersInfoW
GetClientRect
GetFocus
InvalidateRect
GetWindowRect
GetSysColor
LoadBitmapW
GetWindowLongW
SetWindowLongW
GetSystemMetrics
MessageBeep
LoadIconW
DrawFocusRect
FillRect
PeekMessageW
IsWindowEnabled
GetCapture
GetActiveWindow
EnableWindow
GetParent
GetWindow
SetActiveWindow
LockWindowUpdate
UpdateWindow
ReleaseDC
GetDC
SendMessageW
GetNextDlgTabItem

gdi32

SetBkMode
SetMapMode
SetTextAlign
GetViewportExtEx
GetWindowExtEx
PtVisible
RestoreDC
TextOutW
ExtTextOutW
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
GetStockObject
SaveDC
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
CreateCompatibleDC
SelectObject
DeleteDC
GetTextExtentPoint32W
DeleteObject
GetTextAlign
GetTextColor
GetBkColor
CreateSolidBrush
GetDeviceCaps
GetObjectW
RectVisible
GetMapMode
GetRgnBox
CreateRectRgnIndirect
EnumFontFamiliesExW
CreateFontIndirectW

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegDeleteKeyW
RegEnumKeyW
RegOpenKeyW
RegQueryValueW
RegCreateKeyExW
RegSetValueExW

comctl32

ord17
PropertySheetW

shlwapi

PathFindExtensionW
PathFindFileNameW
PathStripToRootW
PathIsUNCW

oledlg

OleUIBusyW

ole32

OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
CoFreeUnusedLibraries
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoRegisterMessageFilter
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
OleInitialize
OleUninitialize

oleaut32

SysAllocStringLen
SysFreeString
VariantClear
SystemTimeToVariantTime
SafeArrayDestroy
SysAllocString
VariantChangeType
VariantInit
SysStringLen
OleCreateFontIndirect
VariantCopy

oleacc

LresultFromObject
CreateStdAccessibleObject

Exports

Exports

_ctime64
_gmtime64
_localtime64
_mktime64
_resetstkoflw
_scprintf
_scwprintf
_time64
_vscprintf
_vscwprintf

Sections

.text
Size: 236KB - Virtual size: 235KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cdata
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 53KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

faa4a507e31e9c82c2b6fae4fe9e7928

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

61:47:52:ba:00:00:00:00:00:04Certificate

Extended Key Usages

Key Usages

61:47:52:ba:00:00:00:00:00:04Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:baCertificate

Extended Key Usages

Key Usages

61:46:9e:cb:00:04:00:00:00:65Certificate

Extended Key Usages

Key Usages

65:e5:ac:ba:40:b7:1e:70:c2:b5:5c:23:e5:48:2f:82:8c:7a:c5:2bSigner

Headers

DLL Characteristics

File Characteristics

Imports

psapi

msimg32

msvcrt

kernel32

user32

gdi32

winspool.drv

advapi32

comctl32

shlwapi

oledlg

ole32

oleaut32

oleacc

Exports

Exports

Sections

.text Size: 236KB - Virtual size: 235KB

.data Size: 108KB - Virtual size: 116KB

.cdata Size: 512B - Virtual size: 4B

.rsrc Size: 53KB - Virtual size: 74KB

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

61:47:52:ba:00:00:00:00:00:04
Certificate

61:47:52:ba:00:00:00:00:00:04
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

61:46:9e:cb:00:04:00:00:00:65
Certificate

65:e5:ac:ba:40:b7:1e:70:c2:b5:5c:23:e5:48:2f:82:8c:7a:c5:2b
Signer

.text
Size: 236KB - Virtual size: 235KB

.data
Size: 108KB - Virtual size: 116KB

.cdata
Size: 512B - Virtual size: 4B

.rsrc
Size: 53KB - Virtual size: 74KB