NEAS[.]d4c891dfbf5efb3ed09a7856f10278a0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.d4c891dfbf5efb3ed09a7856f10278a0.exe
Size

610KB
MD5

d4c891dfbf5efb3ed09a7856f10278a0
SHA1

88182c7e48ff037bd269bb26e84c1d2997ae653d
SHA256

56cbc2d60d283ed21c60451640f83cdee90415f1e4ca2a46c48def631bd4fa11
SHA512

f4d96a3c5569bb1a42ad4a7eb588fa09ecb59994c3e8cfb46e9359f68170587723f2ba6aa6af2896b35ad994a90428588c86eb9b8ab5ad078cffc9afd6f53bd4
SSDEEP

12288:Zu9C4e703rjM9xccLQVx38R4hf8Tvn8CHyNd:Zu9C4AHcJVx38+O78mgd

Score

1^/10

Malware Config

Signatures

Files

NEAS.d4c891dfbf5efb3ed09a7856f10278a0.exe
.exe windows:5 windows x64

5451d192a1dfec85dbb3c0abdf28470f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:1e:44:a5:e2:4e
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

28/01/1999, 13:00

Not After

27/01/2017, 12:00

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:1e:44:a5:ec:be
Certificate

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Not Before

22/01/2004, 10:00

Not After

27/01/2017, 11:00

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:00:00:00:00:01:29:85:61:88:46
Certificate

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Not Before

29/06/2010, 19:23

Not After

23/06/2012, 05:27

Subject

CN=Max Secure Software India Pvt. Ltd.,O=Max Secure Software India Pvt. Ltd.,L=pune,ST=MH,C=IN,1.2.840.113549.1.9.1=#0c1474656368406d617870637365637572652e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0b:7f:6b:00:00:00:00:00:19
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:00

Not After

23/05/2016, 17:10

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c2:92:60:9d:84:e9:45:bb:2f:2b:32:02:96:57:57:c6:1f:a7:a7:9c
Signer

Actual PE Digest

c2:92:60:9d:84:e9:45:bb:2f:2b:32:02:96:57:57:c6:1f:a7:a7:9c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

wininet

InternetCheckConnectionA

kernel32

HeapFree
GetLocalTime
HeapAlloc
GetLogicalDrives
GetSystemTimeAsFileTime
GetDateFormatA
GetTimeFormatA
GetStartupInfoA
ExitProcess
ExitThread
CreateThread
RaiseException
RtlPcToFileHeader
VirtualProtect
VirtualAlloc
VirtualQuery
HeapReAlloc
HeapQueryInformation
HeapSize
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
FlsAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
HeapSetInformation
HeapCreate
RtlUnwindEx
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStdHandle
GetFileType
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
GetDriveTypeA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
RtlLookupFunctionEntry
GetTickCount
GetFileTime
GetFileSizeEx
GetFileAttributesA
SetErrorMode
GetModuleHandleW
GetOEMCP
GetCPInfo
GetFullPathNameA
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetThreadLocale
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
GlobalHandle
GlobalReAlloc
TlsAlloc
InitializeCriticalSection
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GlobalFlags
GetCurrentDirectoryA
WaitForMultipleObjects
ReleaseMutex
FindFirstFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindNextFileA
FindClose
GetModuleFileNameW
FormatMessageA
LocalFree
GlobalGetAtomNameA
GlobalFindAtomA
MultiByteToWideChar
lstrcmpW
WritePrivateProfileStringA
GlobalUnlock
GlobalFree
FreeResource
GetCurrentProcessId
GlobalAddAtomA
CreateEventA
SuspendThread
ResumeThread
SetThreadPriority
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesA
GetModuleFileNameA
CompareStringA
GlobalLock
lstrcmpA
GlobalAlloc
SetFileAttributesA
CopyFileA
DeleteFileA
GetDiskFreeSpaceExA
SetLastError
lstrlenA
CreateToolhelp32Snapshot
Process32First
OpenProcess
ProcessIdToSessionId
Process32Next
WaitForSingleObject
GetModuleHandleA
GetCurrentProcess
CreateFileA
DeviceIoControl
GetEnvironmentVariableA
LoadLibraryA
GetProcAddress
FreeLibrary
GlobalMemoryStatus
GetSystemDefaultLCID
GetLocaleInfoA
GetWindowsDirectoryA
GetVolumeInformationA
GetComputerNameA
GetSystemInfo
GetVersionExA
MulDiv
GetCommandLineA
SetEvent
PulseEvent
UnmapViewOfFile
CreateFileMappingA
GetLastError
OpenFileMappingA
MapViewOfFile
CreateProcessA
CloseHandle
GetSystemDirectoryA
Sleep
WinExec
OutputDebugStringA
WideCharToMultiByte
LoadResource
LockResource
SizeofResource
FindResourceA
CreateMutexA

user32

UnregisterClassA
MessageBeep
GetNextDlgGroupItem
InvalidateRgn
InvalidateRect
SetRect
IsRectEmpty
CopyAcceleratorTableA
CharNextA
CharUpperA
GetSysColorBrush
ReleaseCapture
LoadCursorA
SetCapture
MsgWaitForMultipleObjects
DestroyMenu
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
GetClassLongA
GetClassNameA
GetClassLongPtrA
SetPropA
GetPropA
RemovePropA
SetFocus
GetWindowTextA
GetForegroundWindow
GetTopWindow
GetWindowLongPtrA
SetWindowLongPtrA
UnhookWindowsHookEx
PostThreadMessageA
GetMessagePos
MapWindowPoints
TrackPopupMenu
SetMenu
UpdateWindow
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
EqualRect
GetDlgCtrlID
PtInRect
DefWindowProcA
CallWindowProcA
GetMenu
SetWindowLongA
IntersectRect
GetWindowPlacement
GetWindowRect
GetWindow
SetWindowContextHelpId
MapDialogRect
SetWindowPos
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
IsWindow
GetDlgItem
GetNextDlgTabItem
EndDialog
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
SetCursor
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageA
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
GetFocus
GetParent
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
PostQuitMessage
MessageBoxA
RegisterClipboardFormatA
GetProcessWindowStation
OpenWindowStationA
GetMessageTime
SetProcessWindowStation
CloseWindowStation
OpenDesktopA
CloseDesktop
GetSubMenu
GetMenuItemID
GetMenuItemCount
DrawEdge
LoadBitmapA
OffsetRect
InflateRect
CopyRect
GetMenuItemInfoA
DrawIconEx
SystemParametersInfoA
GetSysColor
GetKeyboardLayout
MapVirtualKeyExA
IsCharLowerA
MapVirtualKeyA
GetKeyNameTextA
SetForegroundWindow
PostMessageA
SetMenuDefaultItem
CreatePopupMenu
GetCursorPos
GetMenuDefaultItem
DestroyIcon
LoadIconA
EnableWindow
GetClientRect
IsIconic
GetSystemMenu
SendMessageA
AppendMenuA
DrawIcon
GetSystemMetrics
AdjustWindowRectEx

gdi32

CreateRectRgnIndirect
GetRgnBox
GetMapMode
GetBkColor
CreateSolidBrush
GetStockObject
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
SelectObject
DeleteObject
SetMapMode
SetBkMode
RestoreDC
SaveDC
GetDeviceCaps
SetBkColor
SetTextColor
GetClipBox
BitBlt
PatBlt
Rectangle
GetTextColor
CreateCompatibleDC
CreateCompatibleBitmap
CreateBitmap
GetObjectA
CreateFontA
CreateFontIndirectA
CreateDIBitmap

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

advapi32

RegQueryInfoKeyA
RegQueryValueA
RegEnumKeyA
RegGetKeySecurity
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegSetKeySecurity
RegUnLoadKeyA
RegLoadKeyA
RegRestoreKeyA
RegSaveKeyA
LookupPrivilegeValueA
AdjustTokenPrivileges
RegFlushKey
RegOpenKeyA
RegCreateKeyA
RegEnumValueA
GetCurrentHwProfileA
RegDeleteValueA
RegEnumKeyExA
RegDeleteKeyA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
GetTokenInformation
LookupAccountSidA
ImpersonateLoggedOnUser
CreateProcessAsUserA
RevertToSelf

shell32

Shell_NotifyIconA
ShellExecuteExA
ShellExecuteA

comctl32

ord17

shlwapi

PathFindFileNameA
PathStripToRootA
PathIsUNCA
PathFindExtensionA

oledlg

ord8

ole32

CoRevokeClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CoGetClassObject

oleaut32

VariantTimeToSystemTime
VariantCopy
SysAllocString
SafeArrayDestroy
OleCreateFontIndirect
SysAllocStringByteLen
SysStringLen
VariantInit
VariantChangeType
VariantClear
SysAllocStringLen
SysFreeString
VarUdateFromDate
SystemTimeToVariantTime

Sections

.text
Size: 386KB - Virtual size: 386KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5451d192a1dfec85dbb3c0abdf28470f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:1e:44:a5:e2:4eCertificate

Key Usages

04:00:00:00:00:01:1e:44:a5:ec:beCertificate

Key Usages

01:00:00:00:00:01:29:85:61:88:46Certificate

Extended Key Usages

Key Usages

61:0b:7f:6b:00:00:00:00:00:19Certificate

Key Usages

c2:92:60:9d:84:e9:45:bb:2f:2b:32:02:96:57:57:c6:1f:a7:a7:9cSigner

Headers

DLL Characteristics

File Characteristics

Imports

wininet

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

Sections

.text Size: 386KB - Virtual size: 386KB

.rdata Size: 139KB - Virtual size: 139KB

.data Size: 14KB - Virtual size: 40KB

.pdata Size: 28KB - Virtual size: 28KB

.rsrc Size: 32KB - Virtual size: 32KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

04:00:00:00:00:01:1e:44:a5:e2:4e
Certificate

04:00:00:00:00:01:1e:44:a5:ec:be
Certificate

01:00:00:00:00:01:29:85:61:88:46
Certificate

61:0b:7f:6b:00:00:00:00:00:19
Certificate

c2:92:60:9d:84:e9:45:bb:2f:2b:32:02:96:57:57:c6:1f:a7:a7:9c
Signer

.text
Size: 386KB - Virtual size: 386KB

.rdata
Size: 139KB - Virtual size: 139KB

.data
Size: 14KB - Virtual size: 40KB

.pdata
Size: 28KB - Virtual size: 28KB

.rsrc
Size: 32KB - Virtual size: 32KB