NEAS[.]474bb0c7d70103fc456d6c44e4d23a20[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.474bb0c7d70103fc456d6c44e4d23a20.exe
Size

70KB
MD5

474bb0c7d70103fc456d6c44e4d23a20
SHA1

626b4cd686687fc60c279b17d8fb727f2c1385bb
SHA256

e15c02d0f1f071843cdb85ccdce0e9eac2beed8caecff328c50d3c45170579fc
SHA512

624ee964a9c701f9a57ff086bd4a3dc601e9292a6150c7361239ce57d551af03acbf17dfb3fd95239719fea33224edade04c832e713cf8985f2271ff53d3562a
SSDEEP

1536:Ja+cd75wOwEV8TGMpaKL7ltfiZst5mnYJeGUGlmZdYL+yC:I+cd6EV8ic7MsnmY9Wc+

Score

1^/10

Malware Config

Signatures

Files

NEAS.474bb0c7d70103fc456d6c44e4d23a20.exe
.dll windows:4 windows x86

47450d4aefaf7a851170755ed51fdc79

Code Sign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:6e:97:13:5b:6e:78:1b:39:d6:4b:78:ab:3e:89:38
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

04-01-2010 00:00

Not After

06-01-2013 23:59

Subject

CN=LIGHT STAR INFORMATION CO.\, LTD.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=LIGHT STAR INFORMATION CO.\, LTD.,L=Taipei,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

25:bb:25:95:d4:87:83:0f:c2:09:4b:20:4c:7f:29:29:14:87:5b:b9
Signer

Actual PE Digest

25:bb:25:95:d4:87:83:0f:c2:09:4b:20:4c:7f:29:29:14:87:5b:b9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CreateFileA
CreateToolhelp32Snapshot
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FreeEnvironmentStringsA
GetACP
GetCPInfo
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStrings
GetFileType
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeW
GetTimeZoneInformation
GetVersion
GetVersionExA
GlobalAddAtomA
GlobalMemoryStatus
HeapAlloc
HeapFree
InitializeCriticalSection
LCMapStringA
LeaveCriticalSection
LoadLibraryA
Process32First
Process32Next
RaiseException
RtlUnwind
SetConsoleCtrlHandler
SetFilePointer
SetHandleCount
SetLastError
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualQuery
WriteFile

gdi32

CreateRectRgn
DeleteObject
GetRegionData

user32

CallNextHookEx
ClientToScreen
EnumThreadWindows
EnumWindows
GetClientRect
GetCursor
GetPropA
GetUpdateRgn
GetWindowRect
IsWindowVisible
MessageBoxA
PostMessageA
PostThreadMessageA
RegisterWindowMessageA
RemovePropA
SetPropA
SetWindowsHookExA
UnhookWindowsHookEx
wsprintfA

Exports

Exports

@@Globalvar@Finalize
@@Globalvar@Initialize
HooksType
LsSuperDecode
LsSuperEncode
MD5Encrypt
SetHooks
SetKeyboardFilterHook
SetKeyboardHook
SetMouseFilterHook
SetMouseHook
UnSetHooks
___CPPdebugHook

Sections

.text
Size: 45KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

SHSEG
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

47450d4aefaf7a851170755ed51fdc79

Code Sign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

61:6e:97:13:5b:6e:78:1b:39:d6:4b:78:ab:3e:89:38Certificate

Extended Key Usages

Key Usages

25:bb:25:95:d4:87:83:0f:c2:09:4b:20:4c:7f:29:29:14:87:5b:b9Signer

Headers

File Characteristics

Imports

kernel32

gdi32

user32

Exports

Exports

Sections

.text Size: 45KB - Virtual size: 48KB

.data Size: 11KB - Virtual size: 28KB

.tls Size: 512B - Virtual size: 4KB

SHSEG Size: 512B - Virtual size: 4KB

.idata Size: 2KB - Virtual size: 4KB

.edata Size: 512B - Virtual size: 4KB

.rsrc Size: 2KB - Virtual size: 4KB

.reloc Size: 3KB - Virtual size: 4KB

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:6e:97:13:5b:6e:78:1b:39:d6:4b:78:ab:3e:89:38
Certificate

25:bb:25:95:d4:87:83:0f:c2:09:4b:20:4c:7f:29:29:14:87:5b:b9
Signer

.text
Size: 45KB - Virtual size: 48KB

.data
Size: 11KB - Virtual size: 28KB

.tls
Size: 512B - Virtual size: 4KB

SHSEG
Size: 512B - Virtual size: 4KB

.idata
Size: 2KB - Virtual size: 4KB

.edata
Size: 512B - Virtual size: 4KB

.rsrc
Size: 2KB - Virtual size: 4KB

.reloc
Size: 3KB - Virtual size: 4KB