NEAS[.]5973e6739b0e85c8aad9306203493a50[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.5973e6739b0e85c8aad9306203493a50.exe
Size

1.1MB
MD5

5973e6739b0e85c8aad9306203493a50
SHA1

7cfbbbec34d4e4399d8488b9bab7d6e26051147f
SHA256

dc9a70fd56feb5fcc3e9191a74a15d0460224095a5e879ad6a97cadb2b644a7f
SHA512

57f0a3511edba376004e2c86022bd6b17b155f509700f05c48d52f150c43e0549eb78911839713ad150ba9cea86c211f994f044307dd2f5106919350163ebd6a
SSDEEP

24576:3T6jk4iMGL98Uy58r6TYITgFxNed0GRP1Gnq:3T6jwL9tuhTYITgF+d061Gnq

Score

1^/10

Malware Config

Signatures

Files

NEAS.5973e6739b0e85c8aad9306203493a50.exe
.exe windows:4 windows x86

11ece362ef7cb1d6b58c264be7718031

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

5c:d0:ce:76:ad:95:ee:77:79:41:cb:5b:5e:c2:a8:c9
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

11/07/2008, 00:00

Not After

11/07/2009, 23:59

Subject

CN=PhoenixStudio.org,OU=Class 3 - for Microsoft Authenticode Signing,O=Beijing Shengjing Wanwei Technology Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

midiStreamClose

ws2_32

WSAGetLastError

imm32

ImmNotifyIME
ImmGetContext
ImmGetOpenStatus
ImmReleaseContext
ImmDisableIME

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

kernel32

FreeLibrary
GetProcAddress
ReadFile
GetFileSize
GetVersionExW
DeviceIoControl
GetTempFileNameW
OpenProcess
GlobalFree
LockResource
SizeofResource
LoadResource
FindResourceW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetWindowsDirectoryW
HeapFree
HeapAlloc
GetProcessHeap
LocalFree
TerminateThread
GetExitCodeThread
LocalFileTimeToFileTime
DosDateTimeToFileTime
CreateFileA
SetLastError
CancelWaitableTimer
SetWaitableTimer
CreateWaitableTimerW
GetDiskFreeSpaceExW
SetEndOfFile
SetFilePointer
WriteFile
GetFileAttributesW
GetSystemDefaultLangID
GetUserDefaultLangID
EnumResourceLanguagesW
GetVersion
FreeResource
TlsFree
ExitProcess
SetUnhandledExceptionFilter
SetProcessWorkingSetSize
TerminateProcess
LoadLibraryExW
SetErrorMode
GlobalDeleteAtom
GlobalAddAtomW
CreateSemaphoreW
ReleaseSemaphore
FlushInstructionCache
TlsGetValue
FileTimeToLocalFileTime
FileTimeToSystemTime
GetCurrentProcessId
GetCommandLineW
lstrcmpW
VirtualProtect
GetCurrentProcess
ReadProcessMemory
WriteProcessMemory
GetLongPathNameW
GetFileTime
SetFileTime
GetLastError
WaitForMultipleObjects
FindNextChangeNotification
GetStartupInfoA
GetModuleHandleA
TlsAlloc
LoadLibraryW
TlsSetValue
GetCurrentThreadId
GetModuleHandleW
LocalAlloc
CreateDirectoryW
lstrlenW
FindClose
FindNextFileW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetShortPathNameW
FindFirstFileW
GetModuleFileNameW
InterlockedDecrement
CloseHandle
DeleteFileW
Sleep
GlobalUnlock
GlobalLock
GlobalAlloc
WideCharToMultiByte
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
lstrlenA
GetTickCount
MultiByteToWideChar
GetTempPathW
lstrcatW
GetLocaleInfoW
WaitForSingleObject
CopyFileW
VirtualQuery
RemoveDirectoryW
CreateMutexW
ReleaseMutex
GetSystemDirectoryW
IsBadWritePtr
IsBadReadPtr
MoveFileExW
MoveFileW
ExpandEnvironmentStringsW
CreateFileW
SystemTimeToFileTime
GetSystemTime
SetFileAttributesW
GetPrivateProfileIntW
lstrcmpiW
ResetEvent
SetEvent
CreateEventW
FindFirstChangeNotificationW
FindCloseChangeNotification

user32

PostQuitMessage
IsMenu
GetMenuStringW
GetMenuItemID
keybd_event
MapVirtualKeyW
CheckMenuRadioItem
SubtractRect
IsChild
EnumChildWindows
IntersectRect
RemoveMenu
SetCursorPos
IsIconic
DialogBoxParamW
LoadImageW
SetWindowPos
GetWindowRect
ShowWindow
SetWindowLongW
GetDlgItem
SendMessageW
LoadStringW
SetWindowTextW
GetWindowTextW
UnhookWindowsHookEx
EndDialog
SetFocus
MessageBoxW
IsWindowVisible
SetWindowsHookExW
CallNextHookEx
SetPropW
ScreenToClient
RemovePropW
GetPropW
CheckDlgButton
EnableWindow
CreateWindowExW
IsWindow
MenuItemFromPoint
SystemParametersInfoW
SetParent
SetActiveWindow
CopyIcon
DrawIconEx
MoveWindow
RegisterClassExW
CopyImage
GetForegroundWindow
CloseClipboard
SetClipboardData
DestroyIcon
EmptyClipboard
InflateRect
CopyRect
GetClientRect
EndPaint
GetSysColor
IsDlgButtonChecked
DrawEdge
DrawTextW
FillRect
BeginPaint
DestroyWindow
SetForegroundWindow
GetParent
DefWindowProcW
ReleaseDC
GetDC
OffsetRect
CallWindowProcW
GetWindowLongW
GetComboBoxInfo
PtInRect
GetCursorPos
GetKeyState
InvalidateRect
GetWindowTextLengthW
GetSystemMetrics
RegisterClipboardFormatW
IsClipboardFormatAvailable
EnableMenuItem
GetSubMenu
LoadMenuW
GetAsyncKeyState
SetCursor
LoadCursorW
OpenClipboard
InsertMenuW
IsWindowEnabled
GetKeyboardLayoutNameW
LoadKeyboardLayoutW
LoadAcceleratorsW
TranslateAcceleratorW
DestroyAcceleratorTable
CreateAcceleratorTableW
CopyAcceleratorTableW
GetKeyNameTextW
GetClipboardData
GetMonitorInfoW
MonitorFromWindow
SetRect
RegisterHotKey
UnregisterHotKey
WindowFromPoint
SetRectEmpty
TrackPopupMenu
TrackPopupMenuEx
GetWindowDC
GetMenuState
EndMenu
EqualRect
GetGUIThreadInfo
GetSystemMenu
PostMessageW
GetMenuInfo
GetMenuItemInfoW
IsZoomed
SetWindowRgn
SetMenuInfo
GetMenuItemCount
CheckMenuItem
GetSysColorBrush
DestroyMenu
FindWindowW
GetWindowPlacement
SetWindowPlacement
TrackMouseEvent
UpdateWindow
RegisterWindowMessageW
GetWindowModuleFileNameW
SetMenuItemInfoW
EnumWindows
GetWindowThreadProcessId
FindWindowExW
GetMenu
SendMessageTimeoutW
EnumThreadWindows
GetClassNameW
GetMessagePos
SetCapture
ReleaseCapture
ShowCursor
KillTimer
ClientToScreen
SetTimer
RedrawWindow
GetFocus
DeleteMenu
GetAncestor
CreatePopupMenu
InsertMenuItemW
GetDlgItemTextW
LoadBitmapW
PeekMessageW
TranslateMessage
DispatchMessageW
CharUpperW
DdeGetData
DdeFreeDataHandle
DdeQueryStringW
DdeFreeStringHandle
DdeUninitialize
DdeInitializeW
DdeCreateStringHandleW
DdeNameService
GetMessageW
PostThreadMessageW
CharLowerW
SetDlgItemTextW
GetDesktopWindow
MapWindowPoints
LoadIconW
DrawIcon
CharNextW

gdi32

CreateRectRgnIndirect
FillRgn
GetDIBits
CreateDIBSection
MoveToEx
LineTo
CreateRoundRectRgn
CombineRgn
CreateRectRgn
SelectClipRgn
GetObjectW
CreateFontIndirectW
Rectangle
SetBkColor
CreatePen
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteDC
CreatePatternBrush
EnumFontsW
GetStockObject
SetTextColor
SetBkMode
SelectObject
CreateSolidBrush
DeleteObject

comdlg32

GetOpenFileNameW
GetSaveFileNameW
ChooseColorW

advapi32

RegDeleteKeyW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
RegGetKeySecurity
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
RegOpenKeyExW
RegCreateKeyW
RegSetValueExW
RegOpenKeyW
RegQueryValueExW
RegCloseKey
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
RegEnumKeyW
RegQueryInfoKeyW
RegSetKeySecurity
CopySid
RegCreateKeyExW
OpenProcessToken
GetTokenInformation
AddAce

shell32

Shell_NotifyIconW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetDesktopFolder
SHGetMalloc
DragQueryFileW
SHAppBarMessage
SHFreeNameMappings
SHChangeNotify
DoEnvironmentSubstW
SHFileOperationW
ShellExecuteW
SHGetSpecialFolderPathW
ExtractIconExW
SHGetFileInfoW
ShellExecuteExW

ole32

OleInitialize
OleCreate
OleUninitialize
OleDraw
CoCreateGuid
CoGetInterfaceAndReleaseStream
CLSIDFromString
StringFromCLSID
CoTaskMemFree
CoRegisterClassObject
CoRevokeClassObject
CoUninitialize
ReleaseStgMedium
RegisterDragDrop
CoGetMalloc
DoDragDrop
CoInitialize
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
RevokeDragDrop
OleDuplicateData
CreateStreamOnHGlobal
CoTaskMemAlloc
OleSetContainedObject

oleaut32

SysStringLen
SafeArrayAccessData
SafeArrayDestroy
SysAllocStringByteLen
SysAllocStringLen
VariantClear
SysAllocString
SysFreeString
SafeArrayCreateVector

wininet

HttpOpenRequestW
HttpSendRequestExW
InternetOpenW
InternetConnectW
InternetSetStatusCallbackW
InternetCloseHandle
InternetReadFileExA
InternetReadFile
HttpEndRequestW
FtpOpenFileW
InternetWriteFile
InternetGetLastResponseInfoW
FtpCommandW
InternetQueryOptionW
FtpGetFileSize
InternetCanonicalizeUrlW
FindFirstUrlCacheEntryW
DeleteUrlCacheEntryW
UnlockUrlCacheEntryFileW
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryA
DeleteUrlCacheEntryA
UnlockUrlCacheEntryFileA
FindNextUrlCacheEntryA
FindCloseUrlCache
InternetSetOptionA
InternetCrackUrlW
GetUrlCacheEntryInfoW
CommitUrlCacheEntryW
CreateUrlCacheEntryW
HttpQueryInfoW
InternetGetConnectedState
InternetSetOptionW

shlwapi

PathFindFileNameW
UrlCombineW
PathMatchSpecW
UrlIsOpaqueW
PathCombineW
StrStrIW
PathFindExtensionW
PathGetDriveNumberW
PathIsDirectoryW
PathIsURLW
SHGetValueW
PathIsRootW
SHAutoComplete
UrlGetPartW
SHSetValueW
SHDeleteKeyW
PathRemoveFileSpecW
StrCpyNW
StrStrIA
PathMatchSpecA
UrlCanonicalizeW
SHEnumKeyExW
SHEnumValueW
StrCmpW
PathFileExistsW
PathIsUNCW
UrlIsW
SHQueryInfoKeyW
StrRetToBufW
SHDeleteValueW

msvcrt

_i64tow
_wtoi64
localtime
wcsftime
gmtime
_ui64tow
swscanf
fseek
ftell
fread
_wtol
_ltow
malloc
free
_wfopen
fwprintf
fclose
iswdigit
swprintf
vswprintf
wcsncmp
_ftol
_wtoi
_except_handler3
wcscat
_snprintf
_itow
wcschr
time
_wcsnicmp
_beginthreadex
memmove
wcscmp
_wcsicmp
wcsstr
??2@YAPAXI@Z
wcsrchr
wcsncpy
wcscpy
_snwprintf
wcslen
wcspbrk
__CxxFrameHandler
wcsncat
fwrite
_purecall
fputs
strrchr
strncpy
strchr
mktime
wcstod
iswspace
realloc
strpbrk
strstr
sscanf
iswlower
atoi
sprintf
fopen
_wstrtime
_strlwr
_CIpow
strncmp
_atoi64
fputws
wcstok
exit
scanf
printf
isalnum
toupper
towlower
towupper
_ismbslead
fprintf
_strnicmp
fgets
rewind
_CxxThrowException
__dllonexit
_onexit
?terminate@@YAXXZ
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
_stricmp
__p__commode
__p__fmode
__set_app_type
??1type_info@@UAE@XZ
_controlfp
strncat

urlmon

ObtainUserAgentString
RegisterBindStatusCallback
RevokeBindStatusCallback
CoInternetCombineUrl
CoInternetGetSession

netapi32

Netbios

gdiplus

GdipSaveImageToFile
GdiplusStartup
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipLoadImageFromStream
GdipAlloc
GdipDeleteGraphics
GdipSetInterpolationMode
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipCreateImageAttributes
GdipCreateFromHDC
GdipFree
GdipDisposeImage
GdipDrawImageRectRectI
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight

comctl32

ImageList_ReplaceIcon
ImageList_Remove
ImageList_Duplicate
ImageList_GetImageCount
ImageList_AddMasked
ImageList_Create
ImageList_DragEnter
ImageList_BeginDrag
ImageList_GetIconSize
InitCommonControlsEx
ImageList_Destroy
ImageList_GetIcon
ImageList_DrawEx
ImageList_GetImageInfo
ImageList_DragShowNolock
ImageList_DragMove
ImageList_EndDrag
ImageList_Add
ImageList_Draw
ord16
ImageList_SetBkColor

Sections

.rdata
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 724KB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 362KB - Virtual size: 361KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

11ece362ef7cb1d6b58c264be7718031

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

5c:d0:ce:76:ad:95:ee:77:79:41:cb:5b:5e:c2:a8:c9Certificate

Extended Key Usages

Key Usages

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0dCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

winmm

ws2_32

imm32

version

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

wininet

shlwapi

msvcrt

urlmon

netapi32

gdiplus

comctl32

Sections

.rdata Size: 63KB - Virtual size: 62KB

.data Size: 724KB - Virtual size: 2.6MB

.rsrc Size: 362KB - Virtual size: 361KB

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

5c:d0:ce:76:ad:95:ee:77:79:41:cb:5b:5e:c2:a8:c9
Certificate

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

.rdata
Size: 63KB - Virtual size: 62KB

.data
Size: 724KB - Virtual size: 2.6MB

.rsrc
Size: 362KB - Virtual size: 361KB