NEAS[.]44f68b3b1537a6eca630c47d75901110[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.44f68b3b1537a6eca630c47d75901110.exe
Size

1.8MB
MD5

44f68b3b1537a6eca630c47d75901110
SHA1

7b34e5fb201c2a03501c77b78d94da07f14f1a0b
SHA256

8e1f5d9d4e29c23c75b57f4bd028625472bea0e4cf4d0780ed13435245cc7235
SHA512

f884bf8f7c54cddf50f0457852194e0185a12caaab90f0bbd577355478d070f650338ce7ad302c009b3220a65894192f3da3013dac80523af7047d6cfef18430
SSDEEP

24576:V1UJOQTP8UB3IL6OBTtezgv7vSTns4tX86+T6PV96xRfXPhbrD7g/4dS4W4VCeF7:MkIC6epeEzvx4ts9T699Oj3iyPj

Score

1^/10

Malware Config

Signatures

Files

NEAS.44f68b3b1537a6eca630c47d75901110.exe
.dll windows:5 windows x86

9a73354b29691f13a80617313057e033

Code Sign

05:b0:ff
Certificate

Issuer

OU=Equifax Secure Certificate Authority,O=Equifax,C=US

Not Before

16/02/2006, 18:01

Not After

19/02/2016, 18:01

Subject

CN=Intel External Basic Policy CA,O=Intel Corporation,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

14:fe:8b:8b:00:01:00:00:84:05
Certificate

Issuer

CN=Intel External Basic Issuing CA 3B,O=Intel Corporation,C=US

Not Before

16/12/2011, 23:53

Not After

30/11/2014, 23:53

Subject

CN=Intel Corporation-Mobile Wireless Group,OU=Mobile Wireless Group,O=Intel Corporation

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:20:8a:62:00:00:00:00:00:08
Certificate

Issuer

CN=Intel External Basic Policy CA,O=Intel Corporation,C=US

Not Before

15/05/2009, 19:27

Not After

15/05/2015, 19:37

Subject

CN=Intel External Basic Issuing CA 3B,O=Intel Corporation,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a2:a2:be:41:5c:62:95:37:bd:3e:bc:01:d6:c9:b9:84:ac:46:4a:2b
Signer

Actual PE Digest

a2:a2:be:41:5c:62:95:37:bd:3e:bc:01:d6:c9:b9:84:ac:46:4a:2b

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryExA
LoadLibraryA
GetProcAddress
GetModuleFileNameA
GetSystemTimeAsFileTime
GetBinaryTypeA
DeleteTimerQueue
SetUserGeoID
CheckRemoteDebuggerPresent
VirtualAlloc
CancelIo
GetModuleHandleW
GetUserDefaultUILanguage

winspool.drv

DeletePrinterDriverExW

shlwapi

PathCombineW
SHRegEnumUSKeyW

user32

SetWindowPlacement
ActivateKeyboardLayout
SetMenuItemInfoW
GetCursor
VkKeyScanExA

msvcrt

isdigit
ldiv

urlmon

CoInternetCreateZoneManager

oleaut32

LoadTypeLibEx
CreateErrorInfo
GetErrorInfo

advapi32

CreatePrivateObjectSecurityEx
ImpersonateAnonymousToken
CryptDuplicateKey

Sections

.text
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 156KB - Virtual size: 155KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 840B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9a73354b29691f13a80617313057e033

Code Sign

05:b0:ffCertificate

Key Usages

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

14:fe:8b:8b:00:01:00:00:84:05Certificate

Extended Key Usages

Key Usages

61:20:8a:62:00:00:00:00:00:08Certificate

Key Usages

a2:a2:be:41:5c:62:95:37:bd:3e:bc:01:d6:c9:b9:84:ac:46:4a:2bSigner

Headers

File Characteristics

Imports

kernel32

winspool.drv

shlwapi

user32

msvcrt

urlmon

oleaut32

advapi32

Sections

.text Size: 36KB - Virtual size: 32KB

.rdata Size: 68KB - Virtual size: 67KB

.data Size: 156KB - Virtual size: 155KB

.CRT Size: 1.5MB - Virtual size: 1.5MB

.rsrc Size: 4KB - Virtual size: 840B

.reloc Size: 28KB - Virtual size: 24KB

05:b0:ff
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

14:fe:8b:8b:00:01:00:00:84:05
Certificate

61:20:8a:62:00:00:00:00:00:08
Certificate

a2:a2:be:41:5c:62:95:37:bd:3e:bc:01:d6:c9:b9:84:ac:46:4a:2b
Signer

.text
Size: 36KB - Virtual size: 32KB

.rdata
Size: 68KB - Virtual size: 67KB

.data
Size: 156KB - Virtual size: 155KB

.CRT
Size: 1.5MB - Virtual size: 1.5MB

.rsrc
Size: 4KB - Virtual size: 840B

.reloc
Size: 28KB - Virtual size: 24KB