NEAS[.]b5059b4375c337f0b7944c3ebbacf690[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.b5059b4375c337f0b7944c3ebbacf690.exe
Size

2.1MB
MD5

b5059b4375c337f0b7944c3ebbacf690
SHA1

0adbbe3d5d640b58a243d3b0347d2881deceaf17
SHA256

8c20f20509c5d0917e0cfbe0cd9e32649dcb332172c14a5b99f2936beb663130
SHA512

35777f3e8e4443b21a41729954ab79f4158783e4d1790c991b60d3656d48b197f76741b28c20f4a295af3c78194181543cc2b7023feecc3371a6769602c3b391
SSDEEP

49152:+J5jC2OQ/lnp8pcI/a7/v5tb8d5XQdwt8kcrINnJKFix8fsnV:CKXpcI/a7n5e5XQdwt8kcshpaoV

Score

1^/10

Malware Config

Signatures

Files

NEAS.b5059b4375c337f0b7944c3ebbacf690.exe
.exe windows:4 windows x86

76e13376304e13e2487be34531cd194c

Code Sign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

13/04/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d2:68:e1:c3:7e:31:89:b8:28:a5:e1:98:34:6a:84:a8
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

25/10/2012, 11:15

Not After

26/10/2015, 11:15

Subject

CN=Centraal Bureau voor de Statistiek,OU=Statistics Netherlands,O=Centraal Bureau voor de Statistiek,L=Heerlen,ST=Limburg,C=NL,1.2.840.113549.1.9.1=#0c0d626c61697365406362732e6e6c

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

46:82:77:cd:3a:0b:a5:ea:2c:d6:0e:85:bf:ce:b0:d3:fe:fc:29:f6
Signer

Actual PE Digest

46:82:77:cd:3a:0b:a5:ea:2c:d6:0e:85:bf:ce:b0:d3:fe:fc:29:f6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

advapi32

RegQueryValueExA

user32

GetKeyboardType

gdi32

UnrealizeObject

version

VerQueryValueA

mpr

WNetOpenEnumA

ole32

IsEqualGUID

comctl32

_TrackMouseEvent

shell32

ShellExecuteExA

winspool.drv

OpenPrinterA

comdlg32

PrintDlgA

oleacc

LresultFromObject

winmm

timeGetTime

crypt32

CertFreeCertificateContext

imagehlp

ImageGetCertificateData

tapi32

tapiRequestMakeCall

msacm32

acmStreamUnprepareHeader

dsound

DirectSoundCaptureEnumerateA

Sections

.text
Size: 2.0MB - Virtual size: 7.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

76e13376304e13e2487be34531cd194c

Code Sign

04:00:00:00:00:01:2f:4e:e1:35:5cCertificate

Extended Key Usages

Key Usages

11:21:d2:68:e1:c3:7e:31:89:b8:28:a5:e1:98:34:6a:84:a8Certificate

Extended Key Usages

Key Usages

46:82:77:cd:3a:0b:a5:ea:2c:d6:0e:85:bf:ce:b0:d3:fe:fc:29:f6Signer

Headers

File Characteristics

Imports

kernel32

oleaut32

advapi32

user32

gdi32

version

mpr

ole32

comctl32

shell32

winspool.drv

comdlg32

oleacc

winmm

crypt32

imagehlp

tapi32

msacm32

dsound

Sections

.text Size: 2.0MB - Virtual size: 7.5MB

.rsrc Size: 31KB - Virtual size: 32KB

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

11:21:d2:68:e1:c3:7e:31:89:b8:28:a5:e1:98:34:6a:84:a8
Certificate

46:82:77:cd:3a:0b:a5:ea:2c:d6:0e:85:bf:ce:b0:d3:fe:fc:29:f6
Signer

.text
Size: 2.0MB - Virtual size: 7.5MB

.rsrc
Size: 31KB - Virtual size: 32KB