NEAS[.]cbcd720cfa13b60e8f278da7a0294200[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.cbcd720cfa13b60e8f278da7a0294200.exe
Size

2.4MB
MD5

cbcd720cfa13b60e8f278da7a0294200
SHA1

d9062aebb089182ecb5b0b9958dfe34ae3103e64
SHA256

1c5d78bbb81298ca7dcf7ceff21ca716e90f5e21cf562954a2c6612743703ada
SHA512

2db0ac6ef71b37ef72a5b5665480e4c9178560545be772063c189a78484179047afafa60b6e78ccc551bbab1742e8de0e7a0f75e5400a20b90a6631d39b832ae
SSDEEP

49152:ub0Tgu4Py3VyOa6g4rgPYP+OI5X7NWsUFicCgTYSnHh:uIT1ja6g4rgwPY5X7NWsUFicCk

Score

1^/10

Malware Config

Signatures

Files

NEAS.cbcd720cfa13b60e8f278da7a0294200.exe
.exe windows:6 windows x86

3bb8a983192e5e1f7a440489b656b933

Code Sign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

32:60:4f:5f:84:3c:56:36:28:b1:14:02:e3:7f:30:24
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

28/07/2020, 00:00

Not After

28/07/2023, 23:59

Subject

CN=Neosonyx Co.\, Ltd.,O=Neosonyx Co.\, Ltd.,L=Geumcheon-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4d:1c:ed:bd:7e:cf:c0:3b:6b:3d:5d:eb:a6:53:4c:33:5a:07:90:7b
Signer

Actual PE Digest

4d:1c:ed:bd:7e:cf:c0:3b:6b:3d:5d:eb:a6:53:4c:33:5a:07:90:7b

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetTimeZoneInformation
ReadConsoleW
SetFilePointerEx
EnumSystemLocalesW
IsValidLocale
GetConsoleMode
GetConsoleCP
SetStdHandle
QueryPerformanceFrequency
VirtualQuery
GetSystemInfo
HeapQueryInformation
GetCommandLineW
IsProcessorFeaturePresent
GetFileType
FreeLibraryAndExitThread
ExitThread
GetModuleHandleExW
FreeEnvironmentStringsW
RtlUnwind
LoadLibraryExA
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
GetCPInfo
LCMapStringW
SwitchToThread
GetStringTypeW
InterlockedDecrement
InterlockedIncrement
GetSystemTime
GetVersionExA
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
GetUserDefaultLCID
GetTempFileNameW
SearchPathW
GetEnvironmentStringsW
ExitProcess
GetProfileIntW
GetTempPathW
VerifyVersionInfoW
VerSetConditionMask
GetWindowsDirectoryW
SystemTimeToTzSpecificLocalTime
GetFileTime
GetFileSizeEx
GetFileAttributesExW
FileTimeToLocalFileTime
GetCurrentDirectoryW
lstrcpyW
lstrcmpiW
IsDebuggerPresent
DuplicateHandle
UnlockFile
LockFile
GetVolumeInformationW
FlushFileBuffers
FindFirstFileW
FileTimeToSystemTime
VirtualProtect
GlobalFlags
GetUserDefaultUILanguage
GetLocaleInfoW
ResumeThread
SetThreadPriority
GlobalGetAtomNameW
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
lstrcmpA
CompareStringW
GlobalFindAtomW
GlobalAddAtomW
GlobalDeleteAtom
LoadLibraryExW
GetModuleHandleA
GetSystemDirectoryW
EncodePointer
CopyFileW
GlobalFree
GlobalSize
FindResourceExW
FindClose
OutputDebugStringA
SetFileAttributesA
SetEndOfFile
SetFilePointer
GetFullPathNameW
GetModuleHandleW
GetDiskFreeSpaceExA
GlobalMemoryStatusEx
GetLogicalDriveStringsA
GetVersionExW
GetDriveTypeA
MulDiv
lstrcmpW
GlobalUnlock
GlobalLock
SetCurrentDirectoryW
FindResourceW
LoadResource
LoadLibraryW
GlobalAlloc
LockResource
CreateFileA
ReleaseMutex
CreateMutexW
SetLastError
SizeofResource
GetFileSize
DeleteFileW
DeleteFileA
InitializeCriticalSection
ReadFile
Sleep
GetProcessHeap
HeapDestroy
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionEx
HeapFree
WriteFile
GetTickCount
CreateDirectoryA
WideCharToMultiByte
CreateProcessW
LocalFree
GetFileAttributesA
GetTickCount64
FormatMessageW
MultiByteToWideChar
GetFileAttributesW
GetModuleFileNameW
GetModuleFileNameA
CreateDirectoryW
GetLocalTime
SetEvent
CreateEventW
WaitForMultipleObjects
K32GetProcessMemoryInfo
WriteConsoleW
FreeConsole
OutputDebugStringW
GetStdHandle
GetPrivateProfileStringA
GetPrivateProfileIntA
WritePrivateProfileStringA
EnterCriticalSection
SetUnhandledExceptionFilter
FreeLibrary
GetCurrentProcessId
GetProcAddress
CreateThread
CloseHandle
LoadLibraryA
GetCurrentThreadId
CreateFileW
WaitForSingleObject
SetErrorMode
GetCurrentProcess
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetCommandLineA
SetEnvironmentVariableW

user32

CharUpperW
DestroyIcon
MapDialogRect
GetAsyncKeyState
GetNextDlgTabItem
CreateDialogIndirectParamW
RealChildWindowFromPoint
GetActiveWindow
SendDlgItemMessageA
CopyImage
GetMenuItemInfoW
DestroyMenu
GetSysColorBrush
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetWindowThreadProcessId
IntersectRect
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetLastActivePopup
GetTopWindow
GetClassLongW
MapWindowPoints
AdjustWindowRectEx
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
ValidateRect
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
IsWindowVisible
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
IsMenu
GetClassInfoW
RegisterClassW
GetMessageTime
GetMessagePos
PeekMessageW
IsWindowEnabled
GetDlgCtrlID
CheckDlgButton
RemoveMenu
AppendMenuW
InsertMenuW
GetMenuItemCount
GetMenuItemID
GetSubMenu
EmptyClipboard
LoadImageW
UnionRect
EqualRect
OffsetRect
UpdateWindow
DialogBoxParamW
ShowWindow
CreateDialogParamW
TranslateMessage
SetTimer
SetCursor
SystemParametersInfoW
PtInRect
GetCursorPos
InflateRect
SetWindowRgn
FrameRect
KillTimer
EnableWindow
IsRectEmpty
SetRectEmpty
LoadImageA
EnumDisplayDevicesW
GetWindowLongW
GetWindowTextLengthW
DefWindowProcW
GetKeyState
CallWindowProcW
ShowOwnedPopups
DeleteMenu
GetNextDlgGroupItem
WindowFromPoint
DrawFocusRect
DrawIconEx
GetIconInfo
MessageBeep
EnableScrollBar
HideCaret
InvertRect
NotifyWinEvent
CreatePopupMenu
GetMenuDefaultItem
DispatchMessageW
MapVirtualKeyW
GetMessageW
SendNotifyMessageW
UnregisterClassW
EndDialog
SendMessageW
CreateWindowExW
SetWindowPos
GetWindowRect
wsprintfA
IsDialogMessageW
GetWindowTextW
EndPaint
BeginPaint
ReleaseDC
IsIconic
InvalidateRect
ReleaseCapture
RegisterWindowMessageW
GetParent
GetClassInfoExW
GetDesktopWindow
PostQuitMessage
GetDlgItem
GetClientRect
SetWindowLongW
SetCapture
GetClassNameW
LoadCursorW
LoadIconW
GetUpdateRect
CharNextW
SetFocus
CreateAcceleratorTableW
MoveWindow
GetSysColor
SetRect
IsChild
GetWindowTextA
DestroyAcceleratorTable
ClientToScreen
CopyRect
RedrawWindow
DrawStateW
SetClassLongW
SetParent
DrawEdge
InvalidateRgn
IsWindow
LoadStringW
DrawIcon
RegisterClassExW
SetWindowTextW
GetSystemMetrics
ScreenToClient
FillRect
MessageBoxW
GetDC
DestroyWindow
GetFocus
TrackMouseEvent
GetKeyNameTextW
LoadMenuW
SetLayeredWindowAttributes
EnumDisplayMonitors
OpenClipboard
CloseClipboard
GetMenuStringW
GetWindow
PostMessageW
DrawFrameControl
IsZoomed
GetSystemMenu
SetClipboardData
BringWindowToTop
SetCursorPos
CopyIcon
UpdateLayeredWindow
MonitorFromPoint
LoadAcceleratorsW
TranslateAcceleratorW
InsertMenuItemW
UnpackDDElParam
ReuseDDElParam
GetComboBoxInfo
PostThreadMessageW
WaitMessage
GetKeyboardLayout
IsCharLowerW
MapVirtualKeyExW
ToUnicodeEx
GetKeyboardState
CopyAcceleratorTableW
DestroyCursor
GetWindowRgn
CreateMenu
SubtractRect
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
DrawMenuBar
IsClipboardFormatAvailable
CharUpperBuffW
RegisterClipboardFormatW
ModifyMenuW
GetDoubleClickTime
SetMenuDefaultItem
LockWindowUpdate
GetMenuState

gdi32

ExcludeClipRect
GetClipBox
GetObjectType
GetPixel
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
PtVisible
RestoreDC
SaveDC
ExtSelectClipRgn
SelectPalette
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextAlign
MoveToEx
TextOutW
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CombineRgn
Escape
PatBlt
SetRectRgn
DPtoLP
GetTextExtentPoint32W
GetTextMetricsW
EnumFontFamiliesExW
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
GetBkColor
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
SetPixel
StretchBlt
SetDIBColorTable
CreateEllipticRgn
Ellipse
GetTextColor
Polygon
Polyline
LPtoDP
Rectangle
GetRgnBox
OffsetRgn
RoundRect
FillRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
GetTextFaceW
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateBitmap
CreateDCW
CopyMetaFileW
FrameRgn
CreateRoundRectRgn
CreatePolygonRgn
CreateFontIndirectW
CreateBrushIndirect
CreateRectRgn
SelectClipRgn
RectVisible
SetDIBitsToDevice
GetDIBits
BitBlt
CreateCompatibleBitmap
SelectObject
CreateDIBSection
CreateCompatibleDC
CreateFontW
GetStockObject
GetDeviceCaps
DeleteDC
SetTextColor
GetObjectW
SetBkColor
DeleteObject
CreateRectRgnIndirect
StretchDIBits
CreateSolidBrush

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
RegEnumKeyExW

shell32

ShellExecuteA
SHGetFileInfoW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetDesktopFolder
SHAppBarMessage
SHBrowseForFolderW
DragFinish
DragQueryFileW
ShellExecuteW

ole32

CoGetClassObject
OleUninitialize
CoInitialize
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
CoInitializeEx
CoDisconnectObject
ReleaseStgMedium
OleDuplicateData
OleLockRunning
CLSIDFromString
OleInitialize
CreateStreamOnHGlobal
CoTaskMemFree
CLSIDFromProgID
CoUninitialize

oleaut32

VariantTimeToSystemTime
LoadRegTypeLi
LoadTypeLi
OleCreateFontIndirect
SysStringLen
SysAllocStringLen
VariantInit
SysFreeString
SysAllocString
VariantChangeType
VariantClear
VarBstrFromDate
VariantCopy
SystemTimeToVariantTime

winmm

PlaySoundW

winhttp

WinHttpOpen
WinHttpReadData
WinHttpCrackUrl
WinHttpConnect
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpSendRequest
WinHttpReceiveResponse

msimg32

AlphaBlend
TransparentBlt

comctl32

ord17

shlwapi

PathStripToRootW
PathIsUNCW
PathFindFileNameW
StrFormatKBSizeW
PathRemoveFileSpecW
PathFindExtensionW

uxtheme

OpenThemeData
DrawThemeParentBackground
GetThemeColor
CloseThemeData
DrawThemeBackground
GetCurrentThemeName
GetWindowTheme
IsAppThemed
IsThemeBackgroundPartiallyTransparent
GetThemeSysColor
GetThemePartSize
DrawThemeText

ws2_32

WSAStartup
WSACleanup
inet_pton
closesocket
send
socket
connect
recv
htons
WSACreateEvent
WSAEventSelect
WSAEnumNetworkEvents

iphlpapi

GetAdaptersInfo

bugtrapu

BT_UninstallSehFilter
BT_SetAppName
BT_SetActivityType
BT_SetSupportServer
BT_SetFlags
BT_SetAppVersion
BT_InstallSehFilter
BT_AddLogFile

steam_api

SteamAPI_RunCallbacks
SteamInternal_FindOrCreateUserInterface
SteamAPI_Init
SteamAPI_RestartAppIfNecessary
SteamAPI_UnregisterCallback
SteamAPI_GetHSteamUser
SteamAPI_Shutdown
SteamInternal_ContextInit
SteamAPI_RegisterCallback

ddraw

DirectDrawCreate

gdiplus

GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipDrawImageRectI
GdipGetImagePaletteSize
GdipDrawImageI
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown
GdipGetImagePalette
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipSetInterpolationMode
GdipGetImagePixelFormat

oleacc

CreateStdAccessibleObject
LresultFromObject
AccessibleObjectFromWindow

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 410KB - Virtual size: 410KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 162KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3bb8a983192e5e1f7a440489b656b933

Code Sign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

32:60:4f:5f:84:3c:56:36:28:b1:14:02:e3:7f:30:24Certificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

4d:1c:ed:bd:7e:cf:c0:3b:6b:3d:5d:eb:a6:53:4c:33:5a:07:90:7bSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

winmm

winhttp

msimg32

comctl32

shlwapi

uxtheme

ws2_32

iphlpapi

bugtrapu

steam_api

ddraw

gdiplus

oleacc

imm32

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 410KB - Virtual size: 410KB

.data Size: 29KB - Virtual size: 50KB

.rsrc Size: 35KB - Virtual size: 34KB

.reloc Size: 162KB - Virtual size: 162KB

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

32:60:4f:5f:84:3c:56:36:28:b1:14:02:e3:7f:30:24
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

4d:1c:ed:bd:7e:cf:c0:3b:6b:3d:5d:eb:a6:53:4c:33:5a:07:90:7b
Signer

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 410KB - Virtual size: 410KB

.data
Size: 29KB - Virtual size: 50KB

.rsrc
Size: 35KB - Virtual size: 34KB

.reloc
Size: 162KB - Virtual size: 162KB