NEAS[.]a417cac01350a1b56aa444a9e7cd4740[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.a417cac01350a1b56aa444a9e7cd4740.exe
Size

85KB
MD5

a417cac01350a1b56aa444a9e7cd4740
SHA1

d1f5dfdce2e3085ecd39e8dd0d4d721b2d847ee3
SHA256

c2e558e9801f7c33f7dfb3bf36985fcedeedff9bbe0e6cf72481802e9cfa291d
SHA512

2fc23a628803270c7aed92263ad7ae25bce4d57219b6443b3042248cbd70aa49bfc1e15672153d6b894d138f509c117e1be5635528f4aa3b79294648466a4ae2
SSDEEP

1536:R4k/KAINkkivVjoG/6Kk+PrgsT/ik7lRL97kItOO5WBL7vg0:3oRi5oG/UoT/V97kItOO5WBfvB

Score

1^/10

Malware Config

Signatures

Files

NEAS.a417cac01350a1b56aa444a9e7cd4740.exe
.dll windows:4 windows x64

4f3ae0eb82cc0034fd9811755f933b77

Code Sign

2f:04:54:b8:f7:b5:7c:53:b1:d1:54:7e:66:df:c6:96
Certificate

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

21/04/2023, 09:03

Not After

20/04/2026, 09:03

Subject

CN=Tobias Junghans,O=Tobias Junghans,L=Chemnitz,ST=Saxony,C=DE,1.2.840.113549.1.9.1=#0c0f6f6666696365407665796f6e2e696f

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

28/07/2022, 08:56

Not After

27/07/2033, 08:56

Subject

CN=Certum Timestamp 2022,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

1e:a7:7a:c6:19:32:8a:a6:36:79:7f:ba:3c:b3:b3:e0:d5:57:ec:69:94:07:fc:1e:04:02:4f:ce:df:ba:0b:f2
Signer

Actual PE Digest

1e:a7:7a:c6:19:32:8a:a6:36:79:7f:ba:3c:b3:b3:e0:d5:57:ec:69:94:07:fc:1e:04:02:4f:ce:df:ba:0b:f2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
GetLastError
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
MultiByteToWideChar
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte

msvcrt

___lc_codepage_func
___mb_cur_max_func
__iob_func
_amsg_exit
_assert
_errno
_initterm
_lock
_read
_unlock
abort
calloc
fflush
fputc
fputs
free
fwrite
isprint
localeconv
malloc
memchr
memcpy
memmove
memset
realloc
strcpy
strerror
strlen
strncmp
strtoul
vfprintf
wcslen
_write
_close

ws2_32

WSAGetLastError
WSASetLastError
closesocket
ioctlsocket
recv
send
shutdown

libssp-0

__chk_fail
__memmove_chk
__stack_chk_fail
__stack_chk_guard

Exports

Exports

ber_alloc
ber_alloc_t
ber_bprint
ber_bvarray_add
ber_bvarray_add_x
ber_bvarray_dup_x
ber_bvarray_free
ber_bvarray_free_x
ber_bvdup
ber_bvecadd
ber_bvecadd_x
ber_bvecfree
ber_bvecfree_x
ber_bvfree
ber_bvfree_x
ber_bvreplace
ber_bvreplace_x
ber_decode_int
ber_decode_oid
ber_dump
ber_dup
ber_dupbv
ber_dupbv_x
ber_encode_oid
ber_errno_addr
ber_error_print
ber_first_element
ber_flatten
ber_flatten2
ber_flush
ber_flush2
ber_free
ber_free_buf
ber_get_bitstringa
ber_get_boolean
ber_get_enum
ber_get_int
ber_get_next
ber_get_null
ber_get_option
ber_get_stringa
ber_get_stringa_null
ber_get_stringal
ber_get_stringb
ber_get_stringbv
ber_get_stringbv_null
ber_get_tag
ber_init
ber_init2
ber_init_w_nullc
ber_int_errno_fn
ber_int_log_proc
ber_int_memory_fns
ber_int_options
ber_int_sb_close
ber_int_sb_destroy
ber_int_sb_init
ber_int_sb_read
ber_int_sb_write
ber_len
ber_log_bprint
ber_log_dump
ber_log_sos_dump
ber_mem2bv
ber_mem2bv_x
ber_memalloc
ber_memalloc_x
ber_memcalloc
ber_memcalloc_x
ber_memfree
ber_memfree_x
ber_memrealloc
ber_memrealloc_x
ber_memvfree
ber_memvfree_x
ber_next_element
ber_peek_element
ber_peek_tag
ber_printf
ber_ptrlen
ber_put_berval
ber_put_bitstring
ber_put_boolean
ber_put_enum
ber_put_int
ber_put_null
ber_put_ostring
ber_put_seq
ber_put_set
ber_put_string
ber_pvt_err_file
ber_pvt_log_output
ber_pvt_log_print
ber_pvt_log_printf
ber_pvt_opt_on
ber_pvt_sb_buf_destroy
ber_pvt_sb_buf_init
ber_pvt_sb_copy_out
ber_pvt_sb_do_write
ber_pvt_sb_grow_buffer
ber_pvt_socket_set_nonblock
ber_pvt_wsa_err2string
ber_read
ber_realloc
ber_remaining
ber_reset
ber_rewind
ber_scanf
ber_set_option
ber_skip_data
ber_skip_element
ber_skip_raw
ber_skip_tag
ber_sockbuf_add_io
ber_sockbuf_alloc
ber_sockbuf_ctrl
ber_sockbuf_free
ber_sockbuf_io_debug
ber_sockbuf_io_fd
ber_sockbuf_io_readahead
ber_sockbuf_io_tcp
ber_sockbuf_remove_io
ber_sos_dump
ber_start
ber_start_seq
ber_start_set
ber_str2bv
ber_str2bv_x
ber_strdup
ber_strdup_x
ber_strndup
ber_strndup_x
ber_strnlen
ber_write
der_alloc
lutil_debug
lutil_debug_file

Sections

.text
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4f3ae0eb82cc0034fd9811755f933b77

Code Sign

2f:04:54:b8:f7:b5:7c:53:b1:d1:54:7e:66:df:c6:96Certificate

Extended Key Usages

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30Certificate

Extended Key Usages

Key Usages

1e:a7:7a:c6:19:32:8a:a6:36:79:7f:ba:3c:b3:b3:e0:d5:57:ec:69:94:07:fc:1e:04:02:4f:ce:df:ba:0b:f2Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

ws2_32

libssp-0

Exports

Exports

Sections

.text Size: 54KB - Virtual size: 54KB

.data Size: 512B - Virtual size: 432B

.rdata Size: 7KB - Virtual size: 7KB

.pdata Size: 3KB - Virtual size: 2KB

.xdata Size: 3KB - Virtual size: 2KB

.bss Size: - Virtual size: 2KB

.edata Size: 3KB - Virtual size: 3KB

.idata Size: 2KB - Virtual size: 2KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 512B - Virtual size: 152B

2f:04:54:b8:f7:b5:7c:53:b1:d1:54:7e:66:df:c6:96
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30
Certificate

1e:a7:7a:c6:19:32:8a:a6:36:79:7f:ba:3c:b3:b3:e0:d5:57:ec:69:94:07:fc:1e:04:02:4f:ce:df:ba:0b:f2
Signer

.text
Size: 54KB - Virtual size: 54KB

.data
Size: 512B - Virtual size: 432B

.rdata
Size: 7KB - Virtual size: 7KB

.pdata
Size: 3KB - Virtual size: 2KB

.xdata
Size: 3KB - Virtual size: 2KB

.bss
Size: - Virtual size: 2KB

.edata
Size: 3KB - Virtual size: 3KB

.idata
Size: 2KB - Virtual size: 2KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 512B - Virtual size: 152B