NEAS[.]a7f03d70d6ed882ef6cd0bcac074cda0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.a7f03d70d6ed882ef6cd0bcac074cda0.exe
Size

129KB
MD5

a7f03d70d6ed882ef6cd0bcac074cda0
SHA1

3915a3178c0eb38c078afbf70edc4d251e26b161
SHA256

da44bd0ccf3e8a4aff7352d1240ebc26445144dfad7aa626b67e38207de0acfa
SHA512

03586bcda37710fa3c16dd1c623c06adca776102da2b06ada15762432592c1cb73f27c3b4e025bd3994cffcd5fce08c88d66a7725b6b021b87ef572d77c9534b
SSDEEP

1536:6yJ2RNpa86gBohaZt0K9uAsIdPHeUBuoArS/mLhvfb8nWp7mBycnM3Gp:6tDa/gBohapuABlHlgL2/gXw276R4Gp

Score

1^/10

Malware Config

Signatures

Files

NEAS.a7f03d70d6ed882ef6cd0bcac074cda0.exe
.dll windows:4 windows x86

6a02263846d58160c9090b3e779d99e4

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fe:b2:be:9d:9f:4a:04:43:15:03:6d:24:ec:7a:3b:78
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

21/06/2010, 00:00

Not After

20/06/2012, 23:59

Subject

CN=深圳市华信安创科技有限公司,OU=Class 3 - for Microsoft Authenticode Signing,O=深圳市华信安创科技有限公司,L=深圳市,ST=广东省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Sleep
GetModuleFileNameA
WideCharToMultiByte
FindClose
FindNextFileA
FindFirstFileA
GetLogicalDriveStringsA
SetFileAttributesA
CreateDirectoryA
GetFileAttributesA
RemoveDirectoryA
DisableThreadLibraryCalls
WriteFile
lstrlenA
DeleteFileA
FreeLibrary
LoadLibraryA
GetProcAddress
GetSystemTime
SetLastError
ReadFile
GetLastError
CloseHandle
CreateFileA
CopyFileA
DeviceIoControl

user32

MessageBoxA
UnregisterDeviceNotification
RegisterDeviceNotificationA

msvcrt

__dllonexit
_onexit
_initterm
_adjust_fdiv
strrchr
_isctype
__mb_cur_max
_pctype
fgetc
toupper
strncat
_strupr
strstr
strncpy
free
??2@YAPAXI@Z
fopen
fread
fclose
??3@YAXPAX@Z
_ftol
sprintf
malloc
_access

Exports

Exports

UKeyDll_ChangePin
UKeyDll_CheckDeviceType
UKeyDll_CloseDev
UKeyDll_DelKeySet
UKeyDll_Format
UKeyDll_GetDevParam
UKeyDll_KeyBegin
UKeyDll_KeyCheck
UKeyDll_KeyEnd
UKeyDll_ListAllDev
UKeyDll_OpenDev
UKeyDll_OpenDevEx
UKeyDll_PersonalInit
UKeyDll_PersonalInitLL
UKeyDll_PlugInType
UKeyDll_PlugInTypeWithStr
UKeyDll_PlugOutType
UKeyDll_PlugOutTypeWithStr
UKeyDll_ReadAccessCred
UKeyDll_ReadConfigDataToKey
UKeyDll_ReadConfigFile
UKeyDll_ReadLicense
UKeyDll_ReadPrvKey
UKeyDll_ReadPubKey
UKeyDll_RegisterNotify
UKeyDll_SetDevParam
UKeyDll_UnLockPin
UKeyDll_UnLockPinLL
UKeyDll_UnRegisterNotify
UKeyDll_VerifyPin
UKeyDll_WriteAccessCred
UKeyDll_WriteConfigDataToKey
UKeyDll_WriteConfigFile
UKeyDll_WriteLicense
UKeyDll_WritePrvKey
UKeyDll_WritePubKey

Sections

.text
Size: 80KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6a02263846d58160c9090b3e779d99e4

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04Certificate

Extended Key Usages

Key Usages

fe:b2:be:9d:9f:4a:04:43:15:03:6d:24:ec:7a:3b:78Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

user32

msvcrt

Exports

Exports

Sections

.text Size: 80KB - Virtual size: 76KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 20KB - Virtual size: 70KB

.rsrc Size: 4KB - Virtual size: 928B

.reloc Size: 8KB - Virtual size: 7KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

fe:b2:be:9d:9f:4a:04:43:15:03:6d:24:ec:7a:3b:78
Certificate

.text
Size: 80KB - Virtual size: 76KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 20KB - Virtual size: 70KB

.rsrc
Size: 4KB - Virtual size: 928B

.reloc
Size: 8KB - Virtual size: 7KB