NEAS[.]de5a5a599a5c6b6420de78c0ad309480[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.de5a5a599a5c6b6420de78c0ad309480.exe
Size

569KB
MD5

de5a5a599a5c6b6420de78c0ad309480
SHA1

ac913ce2e125a3905b0ca049bcaf1916b3915b6f
SHA256

f1dc11e53d0593c20ee44e6f2e70216fec8bd7367cafa3aa91b8c4abad3ea579
SHA512

c6f877143187b0313294f7094a4f0323c0a006414c12eefef4d1332f5e687247a8c78daaf345a9e250bc805f40cd59bc31a8963b7a660ed8fc42ce908e193f39
SSDEEP

12288:qYu6tPlSr+cAJdnMjub+Ld96WOZrimY/862a176/X4D217IOsp4Sh12wHiT5GRTJ:qYTtPRrcRPzFfokv/

Score

1^/10

Malware Config

Signatures

Files

NEAS.de5a5a599a5c6b6420de78c0ad309480.exe
.dll windows:6 windows x86

34d452217fa7b6b2233dc2b416c6458a

Code Sign

08:0a:10:a4:00:9f:7c:11:d7:db:9b:28:c9:d4:6d:93
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

14/01/2020, 00:00

Not After

05/01/2022, 12:00

Subject

CN=Open Media LLC,O=Open Media LLC,L=Nizhny Novgorod,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

0c:16:6f:d7:85:6a:b3:a9:c5:df:1f:ab:8a:d7:c6:8a
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/01/2019, 00:00

Not After

05/01/2022, 12:00

Subject

CN=Open Media LLC,O=Open Media LLC,L=Nizhny Novgorod,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:81:84:d7:72:ef:78:29:97:60:4e:82:59:70:e2:37:8e:4e:2d:24:04:e2:f0:f6:2e:c0:45:a2:40:15:3f:78
Signer

Actual PE Digest

08:81:84:d7:72:ef:78:29:97:60:4e:82:59:70:e2:37:8e:4e:2d:24:04:e2:f0:f6:2e:c0:45:a2:40:15:3f:78

Digest Algorithm

sha256

PE Digest Matches

true

fb:8f:a7:b2:a1:d6:af:ff:88:68:62:a9:f9:7c:cf:54:65:a7:59:8a
Signer

Actual PE Digest

fb:8f:a7:b2:a1:d6:af:ff:88:68:62:a9:f9:7c:cf:54:65:a7:59:8a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

avutil-56

av_freep
av_free
av_log
av_pix_fmt_desc_get
av_get_cpu_flags
av_get_pix_fmt_name
av_mallocz
av_malloc_array
av_get_bits_per_pixel
av_pix_fmt_get_chroma_sub_sample
av_pix_fmt_swap_endianness
av_image_alloc
av_opt_set_defaults
av_opt_set_int
av_opt_get_int
av_mallocz_array
av_malloc

kernel32

TerminateProcess
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetCurrentProcess
UnhandledExceptionFilter
IsProcessorFeaturePresent

vcruntime140

memmove
memcpy
__current_exception_context
_except_handler4_common
__std_type_info_destroy_list
__current_exception
memset

api-ms-win-crt-runtime-l1-1-0

terminate
_cexit
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
abort
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm

api-ms-win-crt-math-l1-1-0

exp2
lrint
_libm_sse2_cos_precise
_libm_sse2_exp_precise
lrintf
_libm_sse2_sin_precise
_libm_sse2_sqrt_precise
ceil
_except1
_libm_sse2_pow_precise

Exports

Exports

sws_addVec
sws_allocVec
sws_alloc_context
sws_alloc_set_opts
sws_cloneVec
sws_convVec
sws_convertPalette8ToPacked24
sws_convertPalette8ToPacked32
sws_freeContext
sws_freeFilter
sws_freeVec
sws_getCachedContext
sws_getCoefficients
sws_getColorspaceDetails
sws_getConstVec
sws_getContext
sws_getDefaultFilter
sws_getGaussianVec
sws_getIdentityVec
sws_get_class
sws_init_context
sws_isSupportedEndiannessConversion
sws_isSupportedInput
sws_isSupportedOutput
sws_normalizeVec
sws_printVec2
sws_scale
sws_scaleVec
sws_setColorspaceDetails
sws_shiftVec
sws_subVec
swscale_configuration
swscale_license
swscale_version

Sections

.text
Size: 517KB - Virtual size: 517KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 265B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

34d452217fa7b6b2233dc2b416c6458a

Code Sign

08:0a:10:a4:00:9f:7c:11:d7:db:9b:28:c9:d4:6d:93Certificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

0c:16:6f:d7:85:6a:b3:a9:c5:df:1f:ab:8a:d7:c6:8aCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

08:81:84:d7:72:ef:78:29:97:60:4e:82:59:70:e2:37:8e:4e:2d:24:04:e2:f0:f6:2e:c0:45:a2:40:15:3f:78Signer

fb:8f:a7:b2:a1:d6:af:ff:88:68:62:a9:f9:7c:cf:54:65:a7:59:8aSigner

Headers

DLL Characteristics

File Characteristics

Imports

avutil-56

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 517KB - Virtual size: 517KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 512B - Virtual size: 39KB

.idata Size: 3KB - Virtual size: 2KB

.00cfg Size: 512B - Virtual size: 265B

.reloc Size: 11KB - Virtual size: 10KB

08:0a:10:a4:00:9f:7c:11:d7:db:9b:28:c9:d4:6d:93
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

0c:16:6f:d7:85:6a:b3:a9:c5:df:1f:ab:8a:d7:c6:8a
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

08:81:84:d7:72:ef:78:29:97:60:4e:82:59:70:e2:37:8e:4e:2d:24:04:e2:f0:f6:2e:c0:45:a2:40:15:3f:78
Signer

fb:8f:a7:b2:a1:d6:af:ff:88:68:62:a9:f9:7c:cf:54:65:a7:59:8a
Signer

.text
Size: 517KB - Virtual size: 517KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 512B - Virtual size: 39KB

.idata
Size: 3KB - Virtual size: 2KB

.00cfg
Size: 512B - Virtual size: 265B

.reloc
Size: 11KB - Virtual size: 10KB