NEAS[.]d3f183e57fdc2c5455916dc2f3e1d520[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.d3f183e57fdc2c5455916dc2f3e1d520.exe
Size

105KB
MD5

d3f183e57fdc2c5455916dc2f3e1d520
SHA1

5c6d72a046984ef2dec758d8a23ecf6af778a928
SHA256

7195b234b6a980f2309cafbf8a5fc99c2569b3218bd8b18021666f102c7b04c9
SHA512

96d72ef9822d6b8b12077f98f901fb8f0960cfef65eb9f22748f7a2f06d7bd22cce313c61ca0929ba2f87ab868102d8fb62427a35a7805225aa69d843f31e2ae
SSDEEP

1536:AGfi0CgBOBCofRgb68puZ6Z1Zlft9MrIZxoCzhdQSN+t7IJNtl4UaVAX2J3hI1eo:AGfKDBgbNY+JMrK+0o7IJflRaVAX24q

Score

1^/10

Malware Config

Signatures

Files

NEAS.d3f183e57fdc2c5455916dc2f3e1d520.exe
.exe windows:6 windows x86

f9f19aa12cf9a3977186c564dfc76d9c

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4e:f1:65:86:a2:ff:12:d6:9c:55:6e:c4:c9:1b:ae:e1
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06/02/2020, 00:00

Not After

01/03/2022, 23:59

Subject

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4e:f1:65:86:a2:ff:12:d6:9c:55:6e:c4:c9:1b:ae:e1
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06/02/2020, 00:00

Not After

01/03/2022, 23:59

Subject

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

22:a0:34:53:33:ac:9e:3c:57:59:12:7a:86:84:e1:9f:e0:84:01:b1:17:4a:ea:45:bb:ce:9d:69:74:41:d4:41
Signer

Actual PE Digest

22:a0:34:53:33:ac:9e:3c:57:59:12:7a:86:84:e1:9f:e0:84:01:b1:17:4a:ea:45:bb:ce:9d:69:74:41:d4:41

Digest Algorithm

sha256

PE Digest Matches

false

7b:70:ed:86:8f:d4:ec:73:69:4c:35:71:3c:3a:e0:ed:34:12:09:21
Signer

Actual PE Digest

7b:70:ed:86:8f:d4:ec:73:69:4c:35:71:3c:3a:e0:ed:34:12:09:21

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DebugBreak
OutputDebugStringA
CloseHandle
SetUnhandledExceptionFilter
GetLastError
SetLastError
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameW
GetFileAttributesW
LoadLibraryW
lstrlenW
SetDllDirectoryW
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Process32First
Process32Next
VirtualProtect
GetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetProcAddress
GetCommandLineW
GetSystemInfo
FreeLibrary
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
MultiByteToWideChar
RaiseException
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
LoadLibraryExA

advapi32

RegOpenKeyExW
RegCreateKeyW
RegCloseKey
RegQueryValueExW

msvcp140

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z

shlwapi

PathFindExtensionW
PathRemoveFileSpecW
PathFindFileNameW

vcruntime140

_except_handler4_common
__vcrt_GetModuleFileNameW
__vcrt_LoadLibraryExW
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__CxxFrameHandler3
memcpy
wcschr
memset
memmove

api-ms-win-crt-runtime-l1-1-0

__p___argc
_exit
_controlfp_s
terminate
_c_exit
exit
_initterm_e
_initterm
__p___argv
_register_thread_local_exe_atexit_callback
_get_initial_narrow_environment
_errno
_set_app_type
_seh_filter_exe
_invalid_parameter_noinfo_noreturn
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv

api-ms-win-crt-heap-l1-1-0

_callnewh
free
malloc
_set_new_mode

api-ms-win-crt-environment-l1-1-0

_wgetenv

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf
__stdio_common_vsprintf
_set_fmode
__p__commode

api-ms-win-crt-string-l1-1-0

strcat_s
wcslen
strlen
strcpy
_wcsicmp
strcpy_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f9f19aa12cf9a3977186c564dfc76d9c

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

4e:f1:65:86:a2:ff:12:d6:9c:55:6e:c4:c9:1b:ae:e1Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

4e:f1:65:86:a2:ff:12:d6:9c:55:6e:c4:c9:1b:ae:e1Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

22:a0:34:53:33:ac:9e:3c:57:59:12:7a:86:84:e1:9f:e0:84:01:b1:17:4a:ea:45:bb:ce:9d:69:74:41:d4:41Signer

7b:70:ed:86:8f:d4:ec:73:69:4c:35:71:3c:3a:e0:ed:34:12:09:21Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

msvcp140

shlwapi

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 39KB - Virtual size: 38KB

.rdata Size: 17KB - Virtual size: 16KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

Size: 46KB - Virtual size: 46KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

4e:f1:65:86:a2:ff:12:d6:9c:55:6e:c4:c9:1b:ae:e1
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

4e:f1:65:86:a2:ff:12:d6:9c:55:6e:c4:c9:1b:ae:e1
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

22:a0:34:53:33:ac:9e:3c:57:59:12:7a:86:84:e1:9f:e0:84:01:b1:17:4a:ea:45:bb:ce:9d:69:74:41:d4:41
Signer

7b:70:ed:86:8f:d4:ec:73:69:4c:35:71:3c:3a:e0:ed:34:12:09:21
Signer

.text
Size: 39KB - Virtual size: 38KB

.rdata
Size: 17KB - Virtual size: 16KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB