NEAS[.]8fa8b9497c575b2ba6a96a1d121217c0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.8fa8b9497c575b2ba6a96a1d121217c0.exe
Size

425KB
MD5

8fa8b9497c575b2ba6a96a1d121217c0
SHA1

4a9eb82f0ef490c4d737fedf8ad57f0da9e70dad
SHA256

40611455608471cacec97aa77872f7573e6469072a137d062ed3d46af3f654e6
SHA512

5d1a6b7afa0fe422455e62f406c5409b451405e65fe4d0d0e1c37d4b7022c465d81ee9787b1490f0487c3b53d90cd971ed81b0b8278f7024ee4e18990f532036
SSDEEP

6144:km00libAY+k9ynmkwhqNQrrYkrtwjZJDGdoAOgcei5+k/9bL:kVymkwhUQdGtdGdolVFVH

Score

1^/10

Malware Config

Signatures

Files

NEAS.8fa8b9497c575b2ba6a96a1d121217c0.exe
.dll windows:4 windows x86

df1655b9e97cb41a1e70d81b87c81014

Code Sign

19:9d:f8:72
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=Time-Stamping Authority WoSign,O=WoSign eCommerce Services Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:9d:f8:9e
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

19:9d:f8:8e
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

08:9f:ba:21:c0:c4:05
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Not Before

02/09/2013, 13:36

Not After

06/12/2016, 04:10

Subject

CN=Beijing Apex Weifeng Technology Co.\,Ltd.,O=Beijing Apex Weifeng Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN,1.2.840.113549.1.9.1=#0c14736572766963654061706578616e74692e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

61:39:bb:9c:00:00:00:00:00:33
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 20:13

Not After

15/04/2021, 20:23

Subject

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

01/03/2011, 01:00

Not After

01/03/2016, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

de:93:8e:1a:37:5a:48:68:83:96:95:c5:b9:d0:83:e0:52:d8:d1:f5
Signer

Actual PE Digest

de:93:8e:1a:37:5a:48:68:83:96:95:c5:b9:d0:83:e0:52:d8:d1:f5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
DeleteFileW
CopyFileW
GetModuleFileNameW
GetLastError
GetFileAttributesW
SetFileAttributesW
GetCurrentProcessId
CloseHandle
GetModuleFileNameA
GetModuleHandleA
VirtualQuery
GetCurrentProcess
DeleteFileA
GetProcAddress
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FreeLibrary
FormatMessageA
LoadLibraryA
VirtualAlloc
VirtualFree
GetFileAttributesA
WaitForSingleObject
CreateProcessA
TerminateProcess
WideCharToMultiByte
Sleep
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapReAlloc
HeapAlloc
GetSystemTimeAsFileTime
GetFileType
RtlUnwind
ExitProcess
DuplicateHandle
MoveFileA
GetTimeFormatA
GetDateFormatA
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
RaiseException
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapSize
HeapDestroy
HeapCreate
WriteFile
GetStdHandle
SetHandleCount
GetStartupInfoA
SetFilePointer
SetStdHandle
CreateFileW
GetConsoleCP
GetConsoleMode
ReadFile
FlushFileBuffers
GetTimeZoneInformation
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CreateFileA
CreatePipe
GetExitCodeProcess
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
CompareStringA
CompareStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetLocaleInfoW
SetEndOfFile
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA

Exports

Exports

DoChk

Sections

.text
Size: 296KB - Virtual size: 294KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

df1655b9e97cb41a1e70d81b87c81014

Code Sign

19:9d:f8:72Certificate

Extended Key Usages

Key Usages

19:9d:f8:9eCertificate

Key Usages

19:9d:f8:8eCertificate

Key Usages

08:9f:ba:21:c0:c4:05Certificate

Extended Key Usages

Key Usages

61:39:bb:9c:00:00:00:00:00:33Certificate

Key Usages

3dCertificate

Key Usages

de:93:8e:1a:37:5a:48:68:83:96:95:c5:b9:d0:83:e0:52:d8:d1:f5Signer

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 296KB - Virtual size: 294KB

.rdata Size: 80KB - Virtual size: 78KB

.data Size: 12KB - Virtual size: 18KB

.rsrc Size: 4KB - Virtual size: 176B

.reloc Size: 20KB - Virtual size: 17KB

19:9d:f8:72
Certificate

19:9d:f8:9e
Certificate

19:9d:f8:8e
Certificate

08:9f:ba:21:c0:c4:05
Certificate

61:39:bb:9c:00:00:00:00:00:33
Certificate

3d
Certificate

de:93:8e:1a:37:5a:48:68:83:96:95:c5:b9:d0:83:e0:52:d8:d1:f5
Signer

.text
Size: 296KB - Virtual size: 294KB

.rdata
Size: 80KB - Virtual size: 78KB

.data
Size: 12KB - Virtual size: 18KB

.rsrc
Size: 4KB - Virtual size: 176B

.reloc
Size: 20KB - Virtual size: 17KB