NEAS[.]363e9720f5513bfbfacd16a3c9f8f9a0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.363e9720f5513bfbfacd16a3c9f8f9a0.exe
Size

1.8MB
MD5

363e9720f5513bfbfacd16a3c9f8f9a0
SHA1

b02043a1581c514ed997bd942044883173689cdc
SHA256

e48221ffc402554ca769ca629518a70354533f956912ae2c65cde5177d9bb423
SHA512

4c35e18bcb00b48a515a1b26033a6f07ad1435e0658a4ab75b1dc364526ca095087521460426150c21c4fc349c3d3f677a98e917f2da868975b18a7c456d5edd
SSDEEP

49152:O7H4eSiFMCHO08trjOuWnYtSZfizAPMOWJkLHB6iTrqhI:EYepMCu0BJna5srLHA6qhI

Score

1^/10

Malware Config

Signatures

Files

NEAS.363e9720f5513bfbfacd16a3c9f8f9a0.exe
.dll windows:5 windows x86

1f2717227a88a529054b832ffbf055ba

Code Sign

33:00:00:02:38:91:cb:4c:c7:11:fd:cd:05:00:00:00:00:02:38
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:07

Not After

08/08/2019, 20:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

12:bc:0b:50:48:f7:3a:4b:46:ad:3b:c9:84:26:e7:95:0a:ab:dc:6d:3b:17:82:f6:be:62:47:a4:a4:67:69:12
Signer

Actual PE Digest

12:bc:0b:50:48:f7:3a:4b:46:ad:3b:c9:84:26:e7:95:0a:ab:dc:6d:3b:17:82:f6:be:62:47:a4:a4:67:69:12

Digest Algorithm

sha256

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

fwrite
rand

advapi32

ImpersonateAnonymousToken
CreateServiceW
SaferIdentifyLevel

user32

EnumDisplayMonitors
SetWindowPlacement
VkKeyScanExA
GetTitleBarInfo
MonitorFromPoint

shlwapi

PathRemoveBlanksA
StrRStrIW

urlmon

FindMimeFromData

winspool.drv

AddPrinterDriverExW

oleaut32

LoadTypeLibEx
GetErrorInfo

ole32

OleLockRunning

kernel32

SetUserGeoID
CheckRemoteDebuggerPresent
GetModuleFileNameA
LoadLibraryExA
VirtualAlloc
OutputDebugStringA
GetCurrentDirectoryW
GetSystemTimeAsFileTime
LoadLibraryA
GetProcAddress
GetBinaryTypeA
DeleteTimerQueue
GetModuleHandleW

Sections

.text
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 156KB - Virtual size: 156KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 840B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1f2717227a88a529054b832ffbf055ba

Code Sign

33:00:00:02:38:91:cb:4c:c7:11:fd:cd:05:00:00:00:00:02:38Certificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

12:bc:0b:50:48:f7:3a:4b:46:ad:3b:c9:84:26:e7:95:0a:ab:dc:6d:3b:17:82:f6:be:62:47:a4:a4:67:69:12Signer

Headers

File Characteristics

Imports

msvcrt

advapi32

user32

shlwapi

urlmon

winspool.drv

oleaut32

ole32

kernel32

Sections

.text Size: 36KB - Virtual size: 32KB

.rdata Size: 68KB - Virtual size: 67KB

.data Size: 156KB - Virtual size: 156KB

.CRT Size: 1.5MB - Virtual size: 1.5MB

.rsrc Size: 4KB - Virtual size: 840B

.reloc Size: 28KB - Virtual size: 24KB

33:00:00:02:38:91:cb:4c:c7:11:fd:cd:05:00:00:00:00:02:38
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

12:bc:0b:50:48:f7:3a:4b:46:ad:3b:c9:84:26:e7:95:0a:ab:dc:6d:3b:17:82:f6:be:62:47:a4:a4:67:69:12
Signer

.text
Size: 36KB - Virtual size: 32KB

.rdata
Size: 68KB - Virtual size: 67KB

.data
Size: 156KB - Virtual size: 156KB

.CRT
Size: 1.5MB - Virtual size: 1.5MB

.rsrc
Size: 4KB - Virtual size: 840B

.reloc
Size: 28KB - Virtual size: 24KB