NEAS[.]97267c72c55778eb9f9d803b56541270[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.97267c72c55778eb9f9d803b56541270.exe
Size

251KB
MD5

97267c72c55778eb9f9d803b56541270
SHA1

eaae04dea1387063c4dc7da7075674b045d51ac4
SHA256

8f7c5505704f72225df9a16f356e5c90e0d2625bb1be208cb9c8e4ff23a6f9e6
SHA512

0fca591e918d9bc06b3269eb98980dc2b650aa429116f0fa52d5d5c056280b8c95df8589cddb118bcb24080f0f990b3babc06bb8d2285943d93658db61df924d
SSDEEP

3072:PTEAB4HuF5Hy8D52q0uCcBW2yG/JgqSMmTLNOAlWsXlyXY/I1ZbNSsBpU44ejzkJ:b3ZAN+1hN7pU4BvkL5jm861FEkZK6S

Score

1^/10

Malware Config

Signatures

Files

NEAS.97267c72c55778eb9f9d803b56541270.exe
.exe windows:5 windows x86

caa3c1d84aed044be8c60e0fb6831e87

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

16/03/2010, 00:00

Not After

15/03/2013, 23:59

Subject

CN=360.cn,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=360.cn,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c1:1a:6c:3f:9e:b6:84:c7:fb:de:43:66:d0:ee:7b:1a:fe:c7:46:17
Signer

Actual PE Digest

c1:1a:6c:3f:9e:b6:84:c7:fb:de:43:66:d0:ee:7b:1a:fe:c7:46:17

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetPrivateProfileIntW
ExitProcess
GetTempFileNameW
CreateMutexW
FindFirstFileW
LoadLibraryExW
InterlockedIncrement
GetModuleHandleW
GetPrivateProfileStringW
InitializeCriticalSection
MultiByteToWideChar
lstrlenW
GetTempPathW
GetLastError
FindClose
lstrcmpiW
FindNextFileW
DeleteCriticalSection
GetVersion
DeleteFileW
LocalFree
GetModuleFileNameA
OpenProcess
Sleep
CloseHandle
WritePrivateProfileStringW
InterlockedCompareExchange
GetProcessHeap
HeapAlloc
GetModuleFileNameW
FlushFileBuffers
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
LeaveCriticalSection
GetCurrentThreadId
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
GetTickCount
QueryPerformanceCounter
GetStartupInfoA
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleMode
GetConsoleCP
CompareStringW
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetStdHandle
RtlUnwind
GetStartupInfoW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetFileType
SetFilePointer
SystemTimeToFileTime
LocalFileTimeToFileTime
DeviceIoControl
SetEndOfFile
CreateEventW
LockResource
EnterCriticalSection
GetProcAddress
SetLastError
RaiseException
FlushInstructionCache
SizeofResource
LoadLibraryW
WideCharToMultiByte
SetEvent
WaitForSingleObject
GetCurrentProcess
InterlockedDecrement
LoadResource
FreeLibrary
FindResourceW
FindResourceExW
GetFileSizeEx
WriteFile
LoadLibraryA
SetFilePointerEx
ReadFile
GetCurrentProcessId
GetEnvironmentVariableW
SetEnvironmentVariableW
TlsFree
TlsAlloc
OpenThread
TlsSetValue
TlsGetValue
ReleaseMutex
CreateFileA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
HeapDestroy
HeapReAlloc
HeapSize
GetSystemTime
FormatMessageW
CreateFileW
GetSystemTimeAsFileTime
OutputDebugStringW
HeapFree

user32

SendMessageW
ShowWindow
MapWindowPoints
GetMonitorInfoW
GetWindow
SetWindowTextW
UnregisterClassA
SetWindowPos
EndDialog
SetWindowLongW
SetWindowRgn
SetTimer
ScreenToClient
TrackPopupMenu
DrawTextW
KillTimer
GetSubMenu
GetWindowInfo
WindowFromPoint
GetForegroundWindow
LoadIconW
OffsetRect
InvalidateRect
GetDlgItem
GetAncestor
GetDesktopWindow
GetCursorPos
IsWindow
FindWindowExW
CreateWindowExW
GetSystemMetrics
IsWindowVisible
DestroyMenu
GetWindowThreadProcessId
GetShellWindow
GetMessageW
CharNextW
TranslateMessage
PeekMessageW
CreateDialogParamW
GetActiveWindow
MessageBoxW
DefWindowProcW
DispatchMessageW
EndPaint
DestroyWindow
GetWindowRect
PostQuitMessage
PostMessageW
SetForegroundWindow
DialogBoxParamW
GetParent
GetClientRect
BeginPaint
GetWindowLongW
MonitorFromWindow
LoadMenuW

gdi32

SetBkMode
DeleteObject
SelectObject
CreateRoundRectRgn
CreateSolidBrush
CreateFontW

advapi32

OpenProcessToken
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
GetTokenInformation
RegQueryValueExA

shell32

Shell_NotifyIconW
SHGetSpecialFolderPathW
CommandLineToArgvW
ShellExecuteW
ShellExecuteExW
ord680
ord165

ole32

CoCreateInstance
OleUninitialize
CoTaskMemFree
CoTaskMemAlloc
OleInitialize
CoTaskMemRealloc

oleaut32

VarUI4FromStr
VariantInit
SysStringLen
SysFreeString
SysStringByteLen
SysAllocStringByteLen
VariantClear
SysAllocString

shlwapi

SHGetValueW
PathFileExistsW
PathIsRelativeW
PathAppendW
PathCombineW
PathRemoveFileSpecW
StrCmpIW
PathFindFileNameW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

psapi

GetModuleFileNameExW

Sections

.text
Size: 177KB - Virtual size: 177KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

caa3c1d84aed044be8c60e0fb6831e87

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

c1:1a:6c:3f:9e:b6:84:c7:fb:de:43:66:d0:ee:7b:1a:fe:c7:46:17Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

version

psapi

Sections

.text Size: 177KB - Virtual size: 177KB

.rdata Size: 34KB - Virtual size: 34KB

.data Size: 7KB - Virtual size: 15KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 27KB - Virtual size: 27KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

c1:1a:6c:3f:9e:b6:84:c7:fb:de:43:66:d0:ee:7b:1a:fe:c7:46:17
Signer

.text
Size: 177KB - Virtual size: 177KB

.rdata
Size: 34KB - Virtual size: 34KB

.data
Size: 7KB - Virtual size: 15KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 27KB - Virtual size: 27KB