NEAS[.]184682b6c175953afb0e522fbfed6040[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.184682b6c175953afb0e522fbfed6040.exe
Size

1.3MB
MD5

184682b6c175953afb0e522fbfed6040
SHA1

e87854fa0c29326a6801a3706e1e182067ee1c82
SHA256

917a3c5dd210ccb207f2c0014a8b42a9d8aa24fc8fc74bfc7c88fde2e78cca27
SHA512

7e159e1b4748c8142b5a4bed6ec0e05a07399c2283e3957e6bbca4e0ccf5280f45515568c25967961f067ebec16dc4af9385a5d5168af74ebd6898dda61ea53c
SSDEEP

24576:O6lRPQXMFWbibwloiaBUt7RnDqFkMBzq7/Qra9QXyR5mDVIhmSc6BYBqqhZs6iZt:8bibwxh6k/QraSXyR54VIL3Aqq3iFJBN

Score

1^/10

Malware Config

Signatures

Files

NEAS.184682b6c175953afb0e522fbfed6040.exe
.exe windows:4 windows x86

7e76a54606280c6e5c6c15a0eb57d8a7

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22-08-2007 22:31

Not After

25-08-2012 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:27:81:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-10-2008 21:24

Not After

22-01-2010 21:34

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16-09-2006 01:55

Not After

16-09-2011 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16-09-2006 01:04

Not After

15-09-2019 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bc:32:51:6a:7f:35:1e:b5:2e:72:b4:b5:0e:6d:56:60:69:65:bb:2c
Signer

Actual PE Digest

bc:32:51:6a:7f:35:1e:b5:2e:72:b4:b5:0e:6d:56:60:69:65:bb:2c

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_controlfp

kernel32

LocalFree

user32

CreateWindowExA

advapi32

CloseServiceHandle

ws2_32

socket

msvcp60

?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z

ole32

CLSIDFromProgID

oleaut32

SetErrorInfo

msvfw32

ICSendMessage

winmm

waveOutClose

iphlpapi

GetInterfaceInfo

psapi

GetMappedFileNameW

shell32

SHGetFolderPathW

Sections

.text
Size: 276KB - Virtual size: 276KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7e76a54606280c6e5c6c15a0eb57d8a7

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:06:27:81:00:00:00:00:00:08Certificate

Extended Key Usages

Key Usages

61:49:7c:ed:00:00:00:00:00:05Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

bc:32:51:6a:7f:35:1e:b5:2e:72:b4:b5:0e:6d:56:60:69:65:bb:2cSigner

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

advapi32

ws2_32

msvcp60

ole32

oleaut32

msvfw32

winmm

iphlpapi

psapi

shell32

Sections

.text Size: 276KB - Virtual size: 276KB

.sedata Size: 1.0MB - Virtual size: 1.0MB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 4KB - Virtual size: 4KB

.sedata Size: 4KB - Virtual size: 4KB

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:06:27:81:00:00:00:00:00:08
Certificate

61:49:7c:ed:00:00:00:00:00:05
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

bc:32:51:6a:7f:35:1e:b5:2e:72:b4:b5:0e:6d:56:60:69:65:bb:2c
Signer

.text
Size: 276KB - Virtual size: 276KB

.sedata
Size: 1.0MB - Virtual size: 1.0MB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 4KB

.sedata
Size: 4KB - Virtual size: 4KB