NEAS[.]6c6953e837eabab07d2736c85bc36890_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.6c6953e837eabab07d2736c85bc36890_JC.exe
Size

5.8MB
MD5

6c6953e837eabab07d2736c85bc36890
SHA1

8a9f00614bbbb0af8076ba48845cef9b4e3be7c9
SHA256

c0f30a849572d82850ba345ca8244c88cca3626a924381613fe645b173594059
SHA512

21080d87e1ea5263340309c5c5201f9f262fe85740cdce410d28147fb84284ac9bb7bf3e7a2090662f330d29222175dc98489e94ed84d80499fdfc9335ff006a
SSDEEP

98304:1KwCpE+mBoEBDeasdzH/cs8cfQW6OUiCpIWLQCIFBRQlt3RHffOYVvsIrqNkJW6L:1KL/ERqH/TQW6OKuWL6FERAIrqNp/8t

Score

1^/10

Malware Config

Signatures

Files

NEAS.6c6953e837eabab07d2736c85bc36890_JC.exe
.dll windows:5 windows x86

5c2d49f08eefd55e492e62b5a3bc70f6

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

af:d3:31:21:0e:f4:60:b7:18:3e:a2:a9:c5:78:18:cc
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

18/11/2022, 00:00

Not After

18/11/2023, 23:59

Subject

CN=Zhou Huabing,O=Zhou Huabing,ST=Central Singapore,C=SG

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b1:23:91:11:d2:f2:2f:e4:f9:09:6d:91:e7:01:35:a8:88:93:e2:74
Signer

Actual PE Digest

b1:23:91:11:d2:f2:2f:e4:f9:09:6d:91:e7:01:35:a8:88:93:e2:74

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

WSASocketW
ioctlsocket
WSARecv
socket
FreeAddrInfoW
GetAddrInfoW
htons
closesocket
getsockopt
setsockopt
getaddrinfo
freeaddrinfo
WSASetLastError
WSAStartup
WSARecvFrom
select
bind
WSAIoctl
WSASend
WSAGetLastError
listen
shutdown

wininet

InternetConnectA
HttpQueryInfoW
HttpQueryInfoA
InternetReadFile
InternetCloseHandle
InternetOpenA
InternetSetOptionW
HttpSendRequestA
InternetErrorDlg
HttpOpenRequestA
InternetQueryOptionW

shell32

DragQueryFileW
SHGetFileInfoW
CommandLineToArgvW
ord74
SHGetPathFromIDListW
Shell_NotifyIconW
ShellExecuteW
ord727
SHBrowseForFolderW
SHGetSpecialFolderPathW
ShellExecuteExW

advapi32

GetUserNameW
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

ole32

CoTaskMemFree
CoCreateInstance
CoCreateGuid
OleUninitialize
OleInitialize
CoUninitialize
ReleaseStgMedium
DoDragDrop
RevokeDragDrop
RegisterDragDrop
CreateStreamOnHGlobal
CoInitialize
CoTaskMemAlloc
CoFreeUnusedLibraries

oleaut32

SysFreeString
SafeArrayCreateVector
SysAllocStringLen
SafeArrayDestroy
SafeArrayPutElement

gdi32

GetGlyphIndicesW
EnumFontFamiliesExW
GetFontUnicodeRanges
GetClipBox
SaveDC
GetStockObject
RestoreDC
BitBlt
StartPage
SetLayout
CreateDCW
SetMapMode
StartDocW
EndPage
StretchDIBits
DeleteObject
CreateBitmap
CreateDIBSection
GetDIBits
SelectObject
DeleteDC
CreateCompatibleDC
GetObjectW
AddFontMemResourceEx
GetDeviceCaps
CreateSolidBrush
GetObjectA
EndDoc
SetViewportOrgEx
CreateFontW

comdlg32

PrintDlgW
GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW

winspool.drv

ord203

kernel32

RaiseException
RtlUnwind
InitializeSListHead
GetSystemTimeAsFileTime
GetModuleHandleW
IsDebuggerPresent
IsProcessorFeaturePresent
FindFirstFileExA
DecodePointer
HeapReAlloc
DeleteFileW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
WaitForSingleObjectEx
HeapSize
GetLogicalDriveStringsW
GetVolumeInformationW
SetThreadPriority
GlobalFree
FormatMessageW
LocalAlloc
LocalSize
lstrcmpW
LoadLibraryW
GetVersionExW
GetThreadPriority
GetTickCount
GetExitCodeThread
GetNativeSystemInfo
CreateTimerQueue
SignalObjectAndWait
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
EnumSystemLocalesW
IsValidLocale
MultiByteToWideChar
FindFirstFileW
FindNextFileW
FindClose
WideCharToMultiByte
VerSetConditionMask
VerifyVersionInfoW
GetFullPathNameW
GetModuleFileNameW
QueryPerformanceCounter
QueryPerformanceFrequency
CompareStringW
GetNumberFormatW
GetCurrencyFormatW
GetDateFormatW
GetTimeFormatW
GetComputerNameW
GetUserDefaultLCID
GetLocaleInfoW
LoadLibraryExW
GetProcAddress
GetSystemTime
SystemTimeToFileTime
GetTimeZoneInformation
FileTimeToSystemTime
OutputDebugStringW
CreateFileW
GetFileSize
CreateFileMappingW
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
GetProcessAffinityMask
SetFilePointer
SetEndOfFile
MulDiv
GetTempPathA
GetTempFileNameA
GetLastError
GetFileAttributesW
Sleep
GetCurrentThreadId
GetCPInfo
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalSize
TryEnterCriticalSection
TlsSetValue
EnterCriticalSection
ReleaseSemaphore
WaitForMultipleObjects
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
ResumeThread
CreateEventW
SetEvent
TlsAlloc
ResetEvent
DeleteCriticalSection
CreateSemaphoreW
TlsGetValue
TlsFree
GetCurrentProcess
SetEnvironmentVariableW
GetEnvironmentVariableW
GetCurrentDirectoryW
GetCurrentProcessId
SetErrorMode
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
ReadFile
SetNamedPipeHandleState
CreateNamedPipeA
SetLastError
WriteFile
RegisterWaitForSingleObject
UnregisterWait
CreateNamedPipeW
PeekNamedPipe
DuplicateHandle
QueueUserWorkItem
GetNamedPipeHandleStateW
GetCurrentThread
SwitchToThread
WaitNamedPipeW
ConnectNamedPipe
FlushFileBuffers
CancelIo
SetHandleInformation
GetConsoleMode
GetFileType
GetModuleHandleA
LoadLibraryA
LocalFree
FormatMessageA
DebugBreak
CreateDirectoryW
DeviceIoControl
RemoveDirectoryW
SetFileTime
CreateHardLinkW
GetFileInformationByHandle
SetFilePointerEx
MoveFileExW
CopyFileW
SetConsoleCtrlHandler
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetConsoleCursorInfo
SetConsoleCursorInfo
FillConsoleOutputCharacterW
ReadConsoleInputW
CreateFileA
ReadConsoleW
WriteConsoleInputW
FillConsoleOutputAttribute
WriteConsoleW
GetNumberOfConsoleInputEvents
SetConsoleCursorPosition
GetLongPathNameW
GetShortPathNameW
ReadDirectoryChangesW
SetInformationJobObject
AssignProcessToJobObject
TerminateProcess
CreateJobObjectW
UnregisterWaitEx
LCMapStringW
CreateProcessW
GetExitCodeProcess
GetStartupInfoW
GetStdHandle
lstrlenW
CreateThread
ExitProcess
FreeLibrary
VirtualAlloc
VirtualProtect
VirtualFree
AllocConsole
HeapFree
GetCommandLineW
HeapAlloc
GetProcessHeap
LoadLibraryExA
GetModuleFileNameA
SetThreadAffinityMask
GetThreadTimes
InterlockedPopEntrySList
QueryDepthSList
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
ExitThread
InterlockedPushEntrySList
CloseHandle
FreeLibraryAndExitThread
GetModuleHandleExW
SetStdHandle
GetConsoleCP
GetFileAttributesExW
SetFileAttributesW
GetStringTypeW
GetACP

user32

InvalidateRect
UpdateWindow
SetWindowPos
AnimateWindow
IsWindowVisible
GetWindowPlacement
RegisterClassW
EndPaint
BeginPaint
GetForegroundWindow
CreateWindowExW
SetTimer
MoveWindow
SetWindowLongW
ShowWindow
DefWindowProcW
GetParent
SendMessageW
DestroyWindow
RedrawWindow
WindowFromPoint
SetForegroundWindow
IsIconic
ScreenToClient
ClientToScreen
MapWindowPoints
RegisterWindowMessageW
LoadIconW
RegisterClassExW
AdjustWindowRectEx
SetClassLongW
GetClassLongW
PostMessageW
KillTimer
GetAsyncKeyState
GetMessageTime
IsWindowUnicode
GetFocus
SetFocus
SetCursor
GetCursorPos
GetScrollInfo
GetWindowTextW
SetWindowTextW
CallMsgFilterW
PeekMessageW
TranslateMessage
EnableWindow
GetCapture
ReleaseCapture
CallNextHookEx
SetWindowsHookExW
UnhookWindowsHookEx
GetActiveWindow
IsChild
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
EnumThreadWindows
IsRectEmpty
GetWindow
FlashWindowEx
MonitorFromPoint
GetKeyboardLayout
CreateCaret
DestroyCaret
SetCaretPos
FindWindowW
RegisterClipboardFormatW
GetDesktopWindow
MessageBeep
NotifyWinEvent
GetDoubleClickTime
GetWindowThreadProcessId
GetSystemMetrics
DestroyIcon
DrawIconEx
IsWindow
GetWindowRect
GetIconInfo
CreateIconIndirect
GetClientRect
SetScrollInfo
LoadCursorFromFileA
LoadCursorW
DestroyCursor
GetSysColor
ReleaseDC
GetDC
SetWinEventHook
GetClipboardSequenceNumber
GetClipboardData
GetWindowLongW
IsClipboardFormatAvailable
GetKeyState
SetClipboardData
EnumClipboardFormats
CountClipboardFormats
CloseClipboard
EmptyClipboard
IsWindowEnabled
MonitorFromWindow
EnumDisplayMonitors
GetMonitorInfoW
EnumDisplayDevicesW
PostQuitMessage
SystemParametersInfoW
MessageBoxA
GetMessageW
MapVirtualKeyW
GetUpdateRect
DispatchMessageW
LoadStringW
UpdateLayeredWindow
SetActiveWindow
MessageBoxW
PostThreadMessageW
SetCapture
GetQueueStatus
MsgWaitForMultipleObjects
OpenClipboard

uxtheme

OpenThemeData
SetWindowTheme
IsThemeBackgroundPartiallyTransparent
DrawThemeBackground
GetThemePartSize
CloseThemeData

shlwapi

PathIsRelativeW

winmm

timeBeginPeriod
timeGetTime
timeSetEvent
timeKillEvent
timeEndPeriod

comctl32

ImageList_GetIconSize
ImageList_Destroy
ImageList_DrawEx

oleacc

LresultFromObject
AccessibleObjectFromWindow

imm32

ImmNotifyIME
ImmReleaseContext
ImmGetContext
ImmGetCompositionStringW
ImmIsIME
ImmSetCandidateWindow
ImmAssociateContextEx

usp10

ScriptFreeCache
ScriptApplyDigitSubstitution
ScriptItemize
ScriptBreak
ScriptShape
ScriptPlace

gdiplus

GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipFillRectangleI
GdipCreatePath
GdipDeletePath
GdipAddPathArcI
GdipAddPathLineI
GdipFillPath
GdipGetClipBoundsI
GdipCreateLineBrush
GdipMultiplyLineTransform
GdipCreateMatrix2
GdipSetLinePresetBlend
GdipSetLineWrapMode
GdipAddPathEllipse
GdipCreatePathGradientFromPath
GdipSetPathGradientPresetBlend
GdipSetPathGradientWrapMode
GdipSetPathGradientCenterPoint
GdipCloneImage
GdipCreatePen1
GdipDeletePen
GdipDrawPath
GdipFillRectanglesI
GdipDrawLine
GdipSetClipRectI
GdipTranslateWorldTransform
GdipGetSmoothingMode
GdipSaveGraphics
GdipRestoreGraphics
GdipBeginContainer2
GdipGetImageGraphicsContext
GdipGraphicsClear
GdipGetPathWorldBounds
GdipClonePath
GdipSetClipRect
GdipAddPathRectangleI
GdipGetImageHeight
GdipGetImageWidth
GdipDeleteGraphics
GdipSetSmoothingMode
GdipEndContainer
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipDrawImageRectRect
GdipTransformPoints
GdipMultiplyWorldTransform
GdipResetWorldTransform
GdipCreateMatrix
GdipDeleteMatrix
GdipGetWorldTransform
GdipGetMatrixElements
GdipTranslateMatrix
GdipRotateMatrix
GdipScaleMatrix
GdipShearMatrix
GdipCreateTexture
GdipFillEllipse
GdipDrawEllipse
GdipFillPie
GdipDrawPie
GdipDrawArc
GdipFillRectangle
GdipDrawRectangle
GdipResetPath
GdipIsVisiblePathPoint
GdipStartPathFigure
GdipAddPathLine
GdipClosePathFigure
GdipSetPathFillMode
GdipAddPathArc
GdipAddPathBezier
GdipSetPageUnit
GdipSetCompositingQuality
GdipSetPixelOffsetMode
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipCreateFromHWND
GdipCreateFromHDC
GdipCreatePen2
GdipSetPenEndCap
GdipSetPenStartCap
GdipSetPenLineJoin
GdipSetPenMiterLimit
GdipSetPenDashStyle
GdipSetPenDashArray
GdipSetPenDashOffset
GdipGetFontSize
GdipDeleteFont
GdipGetCellAscent
GdipCreateFontFromDC
GdipGetLineSpacing
GdipGetEmHeight
GdipCreateFontFromLogfontA
GdipGetFamily
GdipDeleteFontFamily
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromGraphics
GdipDrawImageI
GdipCreateHBITMAPFromBitmap
GdipDrawDriverString
GdipCreateBitmapFromScan0
GdipFree
GdipAlloc
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipDisposeImage
GdipSetPathGradientTransform

Exports

Exports

SciterAPI

Sections

.text
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 166KB - Virtual size: 207KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 269KB - Virtual size: 268KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 277KB - Virtual size: 277KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5c2d49f08eefd55e492e62b5a3bc70f6

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

af:d3:31:21:0e:f4:60:b7:18:3e:a2:a9:c5:78:18:ccCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

b1:23:91:11:d2:f2:2f:e4:f9:09:6d:91:e7:01:35:a8:88:93:e2:74Signer

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

wininet

shell32

advapi32

ole32

oleaut32

gdi32

comdlg32

winspool.drv

kernel32

user32

uxtheme

shlwapi

winmm

comctl32

oleacc

imm32

usp10

gdiplus

Exports

Exports

Sections

.text Size: 4.0MB - Virtual size: 4.0MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 166KB - Virtual size: 207KB

.rsrc Size: 269KB - Virtual size: 268KB

.reloc Size: 277KB - Virtual size: 277KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

af:d3:31:21:0e:f4:60:b7:18:3e:a2:a9:c5:78:18:cc
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

b1:23:91:11:d2:f2:2f:e4:f9:09:6d:91:e7:01:35:a8:88:93:e2:74
Signer

.text
Size: 4.0MB - Virtual size: 4.0MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 166KB - Virtual size: 207KB

.rsrc
Size: 269KB - Virtual size: 268KB

.reloc
Size: 277KB - Virtual size: 277KB