NEAS[.]c8701e1896e030671504b6e917a3bb70[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.c8701e1896e030671504b6e917a3bb70.exe
Size

21KB
MD5

c8701e1896e030671504b6e917a3bb70
SHA1

b787ed61896ef5717345ac311bfce63350f4db27
SHA256

5615f20ecb995140bc2cc8b8c8d942daaaf7aea532791629e42ed8d8a56bcdd9
SHA512

7162be6552f12b07aa5bb7973edae4057728f8f0241d677700a033f16b01896e4c338da959cd735bc0a4c980c7a8462236ff5de1d9432863fa8248ed2e4d1d8c
SSDEEP

384:rt0OvGGwt19WaqJcn5vxcL0nh8i5P7tCEandDGgDgf2hdD7:r5Gft1oNmlxNnDp7tCddDGgUf2hl7

Score

1^/10

Malware Config

Signatures

Files

NEAS.c8701e1896e030671504b6e917a3bb70.exe
.dll windows:6 windows x86

0e4daaf9a8b9571c2f2c7fa781a1d272

Code Sign

07:e2:ef:84:3d:0d:6f:58:cb:bb:06:e3:e8:b3:d3:20
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

06-10-2020 00:00

Not After

31-12-2023 12:00

Subject

CN=The Qt Company Oy,O=The Qt Company Oy,L=Oulu,C=FI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-10-2019 00:00

Not After

17-10-2030 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5a:b6:25:6d:e8:6a:f7:04:e0:25:45:ef:06:e2:5a:4a:18:6f:7b:31:c2:0a:f8:49:02:ed:f3:fe:93:db:e0:67
Signer

Actual PE Digest

5a:b6:25:6d:e8:6a:f7:04:e0:25:45:ef:06:e2:5a:4a:18:6f:7b:31:c2:0a:f8:49:02:ed:f3:fe:93:db:e0:67

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

qt5quick

?defineModule@QQuickWindowModule@@SAXXZ

qt5qml

?qmlRegisterModule@@YAXPBDHH@Z
??1QQmlExtensionPlugin@@UAE@XZ
??0QQmlExtensionPlugin@@QAE@PAVQObject@@@Z
?initializeEngine@QQmlExtensionPlugin@@UAEXPAVQQmlEngine@@PBD@Z
?qt_metacast@QQmlExtensionPlugin@@UAEPAXPBD@Z
?staticMetaObject@QQmlExtensionPlugin@@2UQMetaObject@@B
?qt_metacall@QQmlExtensionPlugin@@UAEHW4Call@QMetaObject@@HPAPAX@Z

qt5core

?eventFilter@QObject@@UAE_NPAV1@PAVQEvent@@@Z
?event@QObject@@UAE_NPAVQEvent@@@Z
?disconnectNotify@QObject@@MAEXABVQMetaMethod@@@Z
?customEvent@QObject@@MAEXPAVQEvent@@@Z
?timerEvent@QObject@@MAEXPAVQTimerEvent@@@Z
?childEvent@QObject@@MAEXPAVQChildEvent@@@Z
?getAndRef@ExternalRefCountData@QtSharedPointer@@SAPAU12@PBVQObject@@@Z
?dynamicMetaObject@QObjectData@@QBEPAUQMetaObject@@XZ
?connectNotify@QObject@@MAEXABVQMetaMethod@@@Z

kernel32

GetCurrentProcess
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetProcAddress
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
CloseHandle
EnterCriticalSection
LeaveCriticalSection
TerminateProcess

vcruntime140

__CxxFrameHandler3
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memset
_except_handler4_common
__std_type_info_destroy_list

api-ms-win-crt-heap-l1-1-0

malloc
free
_callnewh

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
_seh_filter_dll

Exports

Exports

qt_plugin_instance
qt_plugin_query_metadata

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qtmetad
Size: 512B - Virtual size: 109B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0e4daaf9a8b9571c2f2c7fa781a1d272

Code Sign

07:e2:ef:84:3d:0d:6f:58:cb:bb:06:e3:e8:b3:d3:20Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6dCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

5a:b6:25:6d:e8:6a:f7:04:e0:25:45:ef:06:e2:5a:4a:18:6f:7b:31:c2:0a:f8:49:02:ed:f3:fe:93:db:e0:67Signer

Headers

DLL Characteristics

File Characteristics

Imports

qt5quick

qt5qml

qt5core

kernel32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 5KB - Virtual size: 4KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 1KB

.qtmetad Size: 512B - Virtual size: 109B

.rsrc Size: 1024B - Virtual size: 848B

.reloc Size: 1024B - Virtual size: 808B

07:e2:ef:84:3d:0d:6f:58:cb:bb:06:e3:e8:b3:d3:20
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

5a:b6:25:6d:e8:6a:f7:04:e0:25:45:ef:06:e2:5a:4a:18:6f:7b:31:c2:0a:f8:49:02:ed:f3:fe:93:db:e0:67
Signer

.text
Size: 5KB - Virtual size: 4KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 1KB

.qtmetad
Size: 512B - Virtual size: 109B

.rsrc
Size: 1024B - Virtual size: 848B

.reloc
Size: 1024B - Virtual size: 808B