NEAS[.]4081351d4d07ef32b07cb49503065dc0[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.4081351d4d07ef32b07cb49503065dc0.exe
Size

281KB
MD5

4081351d4d07ef32b07cb49503065dc0
SHA1

25335682c67b310a6ba0da79f8347f881386bab3
SHA256

cfb82e6709ad067df1e51949452c5d4d452d1a5528a8ccbc899ae3a0fad1119e
SHA512

655d6ef646566588394e8a2b307aae87188381d807d6c4d2f6263db576aa9f6b23c23ee750880e6a8f502999923245fa348f39954be912514e44400ced8a9806
SSDEEP

3072:Dlo7bsE7kkabJqCbSKGpyHgd81edpThCjMN8AyX8dyb5rIpmGiCjVhWrUhQGhg1J:D7E7kLwpQv16hPmMdybiCrUhQGUKvW

Score

1^/10

Malware Config

Signatures

Files

NEAS.4081351d4d07ef32b07cb49503065dc0.exe
.dll windows:4 windows x86

da5eeca93bffd8b6066b587b7c64ae31

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01-05-2012 00:00

Not After

31-12-2012 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

19:9d:f8:8e
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08-08-2009 01:00

Not After

08-08-2024 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1e:86:ae:2b:bc:24:d1
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Not Before

30-03-2012 22:35

Not After

02-04-2013 07:54

Subject

CN=Shanghai Tongli Information Technology Co.\,Ltd,O=Shanghai Tongli Information Technology Co.\,Ltd,L=Shanghai,ST=Shanghai,C=CN,1.2.840.113549.1.9.1=#0c13736572766963657340746c2d74656b2e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

3d
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

01-03-2011 01:00

Not After

01-03-2016 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

17-09-2006 19:46

Not After

17-09-2036 19:46

Subject

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Key Usages

KeyUsageDigitalSignature
KeyUsageKeyEncipherment
KeyUsageKeyAgreement
KeyUsageCertSign
KeyUsageCRLSign

50:88:1d:31:77:7e:4f:96:e4:6b:40:7f:32:f0:eb:a2:a9:bc:38:ea
Signer

Actual PE Digest

50:88:1d:31:77:7e:4f:96:e4:6b:40:7f:32:f0:eb:a2:a9:bc:38:ea

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

WSAIoctl
select
__WSAFDIsSet
connect
WSAGetLastError
inet_ntoa
inet_addr
ntohl
setsockopt
closesocket
ntohs
socket
send
ioctlsocket
recvfrom
accept
sendto
bind
getsockname
listen
WSAStartup
WSACleanup
WSAJoinLeaf
WSASocketA
recv
htonl
htons
gethostbyname
gethostname

kernel32

TerminateThread
FileTimeToSystemTime
SystemTimeToFileTime
GetSystemTime
DeleteFileA
ReleaseSemaphore
DisableThreadLibraryCalls
CreateSemaphoreA
EnterCriticalSection
LeaveCriticalSection
SetEvent
FormatMessageA
LocalFree
CreateFileA
CreateDirectoryA
OutputDebugStringA
GetTickCount
GetLocalTime
ReleaseMutex
CreateMutexA
Sleep
DeleteCriticalSection
InitializeCriticalSection
CreateEventA
WaitForSingleObject
CloseHandle
CreateThread
GetLastError

user32

PeekMessageA
GetMessageA
wsprintfA
PostThreadMessageA

msvcrt

_strnicmp
fopen
strerror
_errno
strncpy
_stricmp
fflush
fwrite
??3@YAXPAX@Z
??2@YAPAXI@Z
strtok
fread
mktime
sscanf
getenv
time
_initterm
_adjust_fdiv
__dllonexit
_onexit
_close
_open
_write
_lseek
_fstat
_read
fgets
exit
ftell
fseek
strtol
fclose
perror
free
malloc
strncmp
_strdup
fprintf
_iob
_ftol
sprintf
strchr
realloc
_chsize
printf

iphlpapi

GetUdpTable
GetTcpTable
SendARP

winmm

waveInGetNumDevs
waveInOpen
waveInPrepareHeader
waveInStart
waveInAddBuffer
waveOutUnprepareHeader
waveOutClose
waveOutOpen
waveOutPrepareHeader
waveOutWrite
waveInUnprepareHeader
waveInStop
waveInClose
waveOutSetVolume

avcdec

avcdClose
avcdOpen
avcdDecodeOneNal

Exports

Exports

HI_VOICE_DecReset
HI_VOICE_DecodeFrame
HI_VOICE_EncReset
HI_VOICE_EncodeFrame
HI_VOICE_GetVersion
HI_VOICE_TransCodeFrame
HI_VOICE_TransCodeReset
NETDVR_AddUserInfo
NETDVR_CLIENT_regCBDevAlarm
NETDVR_CLIENT_regCBDevException
NETDVR_CLIENT_regCBDevVoip
NETDVR_CLIENT_regCBDeviceState
NETDVR_CLIENT_regCBDeviceUpdate
NETDVR_CLIENT_regCBDeviceUpdate_wifi
NETDVR_CLIENT_regCBGps
NETDVR_CLIENT_regCBMsgConnLost
NETDVR_CtrlCDROM
NETDVR_DeinterlaceVideoFrame
NETDVR_DelUserInfo
NETDVR_EditUserInfo
NETDVR_GetAlarmNoticeParam
NETDVR_GetAudioProperty
NETDVR_GetComParam
NETDVR_GetCruiseParam
NETDVR_GetDeviceInfo
NETDVR_GetDeviceInfo_3g
NETDVR_GetFileFrameSeek
NETDVR_GetMDProperty
NETDVR_GetRecord2State
NETDVR_GetRecordSCH
NETDVR_GetRecordState
NETDVR_GetSubStreamParam
NETDVR_GetUserInfo
NETDVR_GetVGAsoluton
NETDVR_GetVideoBlockParam
NETDVR_GetVideoProperty
NETDVR_GetVoipProperty
NETDVR_IsUpdate
NETDVR_PtzControl
NETDVR_RegCallBackSearchDevice
NETDVR_SearchDevice
NETDVR_SerialSend
NETDVR_SerialStart
NETDVR_SerialStop
NETDVR_SetAlarmNoticeParam
NETDVR_SetAlarmUpload
NETDVR_SetComParam
NETDVR_SetCruiseParam
NETDVR_SetRecordSCH
NETDVR_SetRecordState
NETDVR_SetSubStreamParam
NETDVR_SetVideoBlockParam
NETDVR_SetYTPresetPoint
NETDVR_SetYTTrack
NETDVR_Subsnapshot
NETDVR_VOIPRegCaptureCB
NETDVR_VOIPRegRcvCB
NETDVR_VOIPSendData
NETDVR_VOIPSetSendMode
NETDVR_cleanup
NETDVR_clearAlarms
NETDVR_closeAudioReciever
NETDVR_closePlayCBReciever
NETDVR_closeSubVideoReciever
NETDVR_closeVideoReciever
NETDVR_createClient
NETDVR_createDVR
NETDVR_createDVR_3g
NETDVR_createDVRbyDomain
NETDVR_createSubVideoDecoder
NETDVR_createVideoDecoder
NETDVR_destroyClient
NETDVR_destroyDVR
NETDVR_destroySubVideoDecoder
NETDVR_destroyVideoDecoder
NETDVR_fastPlay
NETDVR_formatHdd
NETDVR_getAlarmInParams
NETDVR_getAlarmOutParams
NETDVR_getBitRateList
NETDVR_getConnectTimeout
NETDVR_getDevException
NETDVR_getDeviceList
NETDVR_getDeviceList_wifi
NETDVR_getMotionDection
NETDVR_getNetworkParams
NETDVR_getPicAdjust
NETDVR_getPtzParams
NETDVR_getRecordParams
NETDVR_getSMTPServerParams
NETDVR_getSysLangList
NETDVR_getSystemParams
NETDVR_getSystemTime
NETDVR_getVideoLost
NETDVR_getVideoParams
NETDVR_getxwServerParams
NETDVR_logSearch
NETDVR_logSearchClean
NETDVR_loginServer
NETDVR_loginServer_3g
NETDVR_logoutServer
NETDVR_logoutServer_3g
NETDVR_mutePreViewAudio
NETDVR_openAudioReciever
NETDVR_openPlayCBReciever
NETDVR_openSubVideoReciever
NETDVR_openVideoReciever
NETDVR_pausePlay
NETDVR_playMute
NETDVR_playNext
NETDVR_playPrevious
NETDVR_playProgress
NETDVR_playSeek
NETDVR_reboot
NETDVR_recFilesSearch
NETDVR_recFilesSearchClean
NETDVR_regCBAlarmState
NETDVR_regCBDeviceChnState
NETDVR_regCBFileRecieverError
NETDVR_regCBFileRecieverError_wifi
NETDVR_regCBFileRecieverProgress
NETDVR_regCBFileRecieverProgress_wifi
NETDVR_regCBGetPlayEncFrame
NETDVR_regCBMsgConnLost
NETDVR_regCBMsgGetFileFrameOver
NETDVR_regCBMsgGetFileFrameProgress
NETDVR_regCBMsgHasAudio
NETDVR_regCBMsgPlayOver
NETDVR_regCBMsgProgress
NETDVR_regCBMsgReconnect
NETDVR_regCBSendProgress
NETDVR_regCBUpdateError
NETDVR_regCBUpdateProgress
NETDVR_regDecAudioFrameCB
NETDVR_remoteGetHddInfo
NETDVR_remoteGetHddInfo_3g
NETDVR_remoteGetSysVerInfo
NETDVR_remoteGetSysVerInfo_3g
NETDVR_restoreFactorySettings
NETDVR_resumePlay
NETDVR_sdkCheckout
NETDVR_sendExtendCmd
NETDVR_setAlarmInParams
NETDVR_setAlarmOutParams
NETDVR_setConnectTimeout
NETDVR_setDecoderFMT
NETDVR_setMotionDection
NETDVR_setNetworkParams
NETDVR_setPicAdjust
NETDVR_setPlayCBAudioMute
NETDVR_setPlayCBDecoderFMT
NETDVR_setPlayRate
NETDVR_setPtzParams
NETDVR_setReconnectFlag
NETDVR_setReconnectTime
NETDVR_setRecord2CB
NETDVR_setRecord2FileNameCB
NETDVR_setRecordCB
NETDVR_setRecordFileNameCB
NETDVR_setRecordParams
NETDVR_setSMTPServerParams
NETDVR_setSubDecoderFMT
NETDVR_setSubRecordCB
NETDVR_setSubRecordFileNameCB
NETDVR_setSubVideoDecFlag
NETDVR_setSystemParams
NETDVR_setSystemTime
NETDVR_setVideoDecFlag
NETDVR_setVideoLost
NETDVR_setVideoParams
NETDVR_setxwServerParams
NETDVR_shutdown
NETDVR_singleFramePlay
NETDVR_slowPlay
NETDVR_snapshot
NETDVR_startAudioSend
NETDVR_startDeviceState
NETDVR_startFileDownload
NETDVR_startFilePlay
NETDVR_startGetFileFrameByFile
NETDVR_startGps
NETDVR_startRecord
NETDVR_startRecord2
NETDVR_startSubRecord
NETDVR_startSubVideoSend
NETDVR_startTimePlay
NETDVR_startUpdate
NETDVR_startVOIP
NETDVR_startVideoSend
NETDVR_startYuntaiCruise
NETDVR_startup
NETDVR_stopAudioSend
NETDVR_stopDeviceState
NETDVR_stopFileDownload
NETDVR_stopFilePlay
NETDVR_stopGetFileFrameByFile
NETDVR_stopGps
NETDVR_stopRecord
NETDVR_stopRecord2
NETDVR_stopSubRecord
NETDVR_stopSubVideoSend
NETDVR_stopTimePlay
NETDVR_stopUpdate
NETDVR_stopVOIP
NETDVR_stopVideoSend
NETDVR_stopYuntaiCruise
TL_CloseFile
TL_FILEDecAudioFrame
TL_FileAudioBits
TL_FileAudioFrameNum
TL_FileAudioSampleRate
TL_FileDecVideoFrame
TL_FileEndTime
TL_FileHasAudio
TL_FileReadOneAudioFrame
TL_FileReadOneMediaFrame
TL_FileReadOneVideoFrame
TL_FileSeekToNextSeg
TL_FileSeekToPrevSeg
TL_FileSeekToSysTime
TL_FileSetAudio
TL_FileSetVideo
TL_FileStartTime
TL_FileTotalTime
TL_FileVideoFrameNum
TL_FileVideoHeight
TL_FileVideoWidth
TL_FileWriteAudioFrame
TL_FileWriteVideoFrame
TL_OpenFile

Sections

.text
Size: 212KB - Virtual size: 211KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 345KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

da5eeca93bffd8b6066b587b7c64ae31

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

19:9d:f8:8eCertificate

Key Usages

1e:86:ae:2b:bc:24:d1Certificate

Extended Key Usages

Key Usages

3dCertificate

Key Usages

01Certificate

Key Usages

50:88:1d:31:77:7e:4f:96:e4:6b:40:7f:32:f0:eb:a2:a9:bc:38:eaSigner

Headers

File Characteristics

Imports

ws2_32

kernel32

user32

msvcrt

iphlpapi

winmm

avcdec

Exports

Exports

Sections

.text Size: 212KB - Virtual size: 211KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 20KB - Virtual size: 345KB

.idata Size: 4KB - Virtual size: 3KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 12KB - Virtual size: 8KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

19:9d:f8:8e
Certificate

1e:86:ae:2b:bc:24:d1
Certificate

3d
Certificate

01
Certificate

50:88:1d:31:77:7e:4f:96:e4:6b:40:7f:32:f0:eb:a2:a9:bc:38:ea
Signer

.text
Size: 212KB - Virtual size: 211KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 20KB - Virtual size: 345KB

.idata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 12KB - Virtual size: 8KB