NEAS[.]1469fcc12be7b12c1cf8a50658135ed0_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.1469fcc12be7b12c1cf8a50658135ed0_JC.exe
Size

99KB
MD5

1469fcc12be7b12c1cf8a50658135ed0
SHA1

2b17322187cdaeb30d3b0f1cf2c9899f45238a34
SHA256

153332d19dff6180bd3223b60931ed1ff0571373905ed23d60b5d112020d5472
SHA512

df4c44b32297567af08347b555d6e2c17c0c5e1f1af7d6e8779c63181775d851aecaa38e564ee49413e0f023c180208e6c1c0b7b9e0982b68b29e5241db4bb63
SSDEEP

1536:VYtu3VIA/C22pH7fbOM2tpMOTdC3EPMLTTzFG8rlgOAB6hM5P1:Vxhq22pbj2tHTdC3ZHlgPchM5t

Score

1^/10

Malware Config

Signatures

Files

NEAS.1469fcc12be7b12c1cf8a50658135ed0_JC.exe
.dll windows:10 windows x64

de0210fe15c9779dfa75f8ca5ed2a8ee

Code Sign

33:00:00:01:74:69:de:10:8b:37:65:a8:d7:00:00:00:00:01:74
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:23

Not After

11/08/2018, 20:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:b2:1e:52:de:16:dc:37:68:bd:d5:19:e1:15:26:88:c9:ac:d0:b7:05:5d:f7:9e:bc:f0:28:01:8b:df:1f:e6
Signer

Actual PE Digest

27:b2:1e:52:de:16:dc:37:68:bd:d5:19:e1:15:26:88:c9:ac:d0:b7:05:5d:f7:9e:bc:f0:28:01:8b:df:1f:e6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

memset
__CxxFrameHandler3
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
_wcsicmp
_wcsnicmp
_vsnwprintf
__C_specific_handler
memcmp
memcpy
wcscmp

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
SetLastError

api-ms-win-core-libraryloader-l1-1-0

DisableThreadLibraryCalls
GetModuleFileNameW
FreeLibrary
GetProcAddress

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSection
CreateEventW

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapDestroy
HeapAlloc

api-ms-win-service-management-l1-1-0

OpenServiceW
CloseServiceHandle
OpenSCManagerW

api-ms-win-service-management-l2-1-0

QueryServiceStatusEx

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoUninitialize
CoCreateInstance

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExW
RegDeleteValueW
RegGetValueW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegNotifyChangeKeyValue

api-ms-win-core-string-l1-1-0

CompareStringW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetTickCount64
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-file-l1-1-0

FindClose
FindFirstFileW
DeleteFileW
FindNextFileW

api-ms-win-core-shlwapi-obsolete-l1-1-0

SHLoadIndirectString

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentProcessId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

oleaut32

SysStringLen
VariantClear
SysAllocString
SysFreeString

wcp

ConvertNtStatusToHResult
?RtlTraceFormat_PCHRESULT@Rtl@WCP@Windows@@YAXPEAUIRtlFormattedOutputStream@13@PEBX@Z
?RtlTraceFormat_PCSTR@Rtl@WCP@Windows@@YAXPEAUIRtlFormattedOutputStream@13@PEBX@Z
?RtlTraceFormat_PCWSTR@Rtl@WCP@Windows@@YAXPEAUIRtlFormattedOutputStream@13@PEBX@Z
?RtlTraceFormat_PCULONG@Rtl@WCP@Windows@@YAXPEAUIRtlFormattedOutputStream@13@PEBX@Z
?RtlTraceVa@Rtl@WCP@Windows@@YAXKKPEAU_RTL_TRACING_FACILITY@123@QEBD_KPEAD@Z
RtlInitLUnicodeStringFromNullTerminatedString
RtlReportErrorOrigination

setupapi

SetupGetInfDriverStoreLocationW

winspool.drv

EnumPortsW
DeleteMonitorW
AddMonitorW
InstallPrinterDriverFromPackageW
UploadPrinterDriverPackageW
EnumPrinterDriversW
DeletePrinterDriverPackageW
DeletePrinterDriverExW
DeletePrinter
EnumPrintersW
AddPrinterW
EnumPrintProcessorsW
ClosePrinter
SetPrinterDataW
GetPrinterW
OpenPrinterW
SetPrinterW

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-core-kernel32-legacy-l1-1-0

LoadLibraryW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW

shell32

SHGetMalloc
SHGetSpecialFolderLocation
SHChangeNotify

Exports

Exports

DllCanUnloadNow
DllCsiGetHandler
InstallLocalFaxPrinter
UninstallLocalFaxPrinter

Sections

.text
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

de0210fe15c9779dfa75f8ca5ed2a8ee

Code Sign

33:00:00:01:74:69:de:10:8b:37:65:a8:d7:00:00:00:00:01:74Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

27:b2:1e:52:de:16:dc:37:68:bd:d5:19:e1:15:26:88:c9:ac:d0:b7:05:5d:f7:9e:bc:f0:28:01:8b:df:1f:e6Signer

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

oleaut32

wcp

setupapi

winspool.drv

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-debug-l1-1-0

shell32

Exports

Exports

Sections

.text Size: 49KB - Virtual size: 49KB

.rdata Size: 36KB - Virtual size: 35KB

.data Size: 1KB - Virtual size: 5KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 128B

33:00:00:01:74:69:de:10:8b:37:65:a8:d7:00:00:00:00:01:74
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

27:b2:1e:52:de:16:dc:37:68:bd:d5:19:e1:15:26:88:c9:ac:d0:b7:05:5d:f7:9e:bc:f0:28:01:8b:df:1f:e6
Signer

.text
Size: 49KB - Virtual size: 49KB

.rdata
Size: 36KB - Virtual size: 35KB

.data
Size: 1KB - Virtual size: 5KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 128B