NEAS[.]ef5be6cb0ebafe3c21685b5c9ed99bb0[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.ef5be6cb0ebafe3c21685b5c9ed99bb0.exe
Size

232KB
MD5

ef5be6cb0ebafe3c21685b5c9ed99bb0
SHA1

8190b109916103148a89bdcd783dddde9af6faf3
SHA256

1d868984ca79d0f50ccfb558d762d2a1efc3d26ffaee06f53940d26ac84cac64
SHA512

25325202e48690874074d81a1688fdb3e515daa90caf410100d421dec85128ed859f9aeaa552965d45266ee395ae5c2d8e0a64746631a570ad5cdba1bf17e868
SSDEEP

1536:d7zbyuK/UIDVUxarHRKZXXa1+f5FcH7ESEvlyGFqXUAmE/HhgHLoD9yzah54BvKs:d7PEIMOOUAZPGrSYah54BvKcE3U7hZ

Score

1^/10

Malware Config

Signatures

Files

NEAS.ef5be6cb0ebafe3c21685b5c9ed99bb0.exe
.dll windows:5 windows x64

d6444ed78689e89bc9c12149321f1713

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

1c:2a:6c:36:74:f6:24:56:61:c7:76:e4:66:eb:84:c9
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25-08-2010 00:00

Not After

24-08-2013 23:59

Subject

CN=Pelikan Software KFT,O=Pelikan Software KFT,POSTALCODE=1025,STREET=Zoldko u. 4/a,L=Budapest,ST=Budapest,C=HU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d1:f0:a0:57:1c:1d:20:35:a3:18:af:03:47:87:6b:40:3d:17:3b:49
Signer

Actual PE Digest

d1:f0:a0:57:1c:1d:20:35:a3:18:af:03:47:87:6b:40:3d:17:3b:49

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

pecore

??0ivUnknown@@QEAA@XZ
?AddRef@ivUnknown@@UEAAIXZ
?Release@ivUnknown@@UEAAIXZ
?GetValue@ivUnknown@@UEAAJ_KAEAVpe_value@@@Z
?SetValue@ivUnknown@@UEAAJ_KAEAVpe_value@@@Z
?QueryInterface@pe_Flt2d@@UEAAJAEBUpe_GUID@@PEAPEAX@Z
?IsTypeOf@pe_Flt2d@@UEAA_NAEBUpe_GUID@@@Z
?pe_Error@@YAXPEBDZZ
?ivRealloc@@YAPEAXPEAX_K@Z
?ivFree@@YAXPEAX@Z
?ivAlloc@@YAPEAX_K@Z
?CreateInterface@@YAJAEBUpe_GUID@@PEAPEAX@Z
?Init@pe_value@@QEAAXM@Z
?Init@pe_value@@QEAAXI@Z
??1pe_value@@QEAA@XZ
?Get@pe_value@@QEBA_NAEAM@Z

msvcr100

_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
__CppXcptFilter
__C_specific_handler
_amsg_exit
_encoded_null
free
memcpy
vsprintf
memset
pow
floor
strncmp
strlen
strcpy
sprintf
qsort
fprintf
bsearch
atan2
sqrt
log
rand
exp
fabs
_malloc_crt
_initterm
_initterm_e

kernel32

GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
EncodePointer
QueryPerformanceCounter
DisableThreadLibraryCalls
Sleep
DecodePointer

Exports

Exports

pe_entrypoint

Sections

.text
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d6444ed78689e89bc9c12149321f1713

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

1c:2a:6c:36:74:f6:24:56:61:c7:76:e4:66:eb:84:c9Certificate

Extended Key Usages

Key Usages

d1:f0:a0:57:1c:1d:20:35:a3:18:af:03:47:87:6b:40:3d:17:3b:49Signer

Headers

DLL Characteristics

File Characteristics

Imports

pecore

msvcr100

kernel32

Exports

Exports

Sections

.text Size: 92KB - Virtual size: 91KB

.rdata Size: 128KB - Virtual size: 128KB

.data Size: 2KB - Virtual size: 2KB

.pdata Size: 3KB - Virtual size: 2KB

.reloc Size: 1KB - Virtual size: 1KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

1c:2a:6c:36:74:f6:24:56:61:c7:76:e4:66:eb:84:c9
Certificate

d1:f0:a0:57:1c:1d:20:35:a3:18:af:03:47:87:6b:40:3d:17:3b:49
Signer

.text
Size: 92KB - Virtual size: 91KB

.rdata
Size: 128KB - Virtual size: 128KB

.data
Size: 2KB - Virtual size: 2KB

.pdata
Size: 3KB - Virtual size: 2KB

.reloc
Size: 1KB - Virtual size: 1KB