NEAS[.]839b4b0c3939e2da55fa881875939f60[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.839b4b0c3939e2da55fa881875939f60.exe
Size

382KB
MD5

839b4b0c3939e2da55fa881875939f60
SHA1

9034fb5ed9ddf33c8557a9ed49c2403a097b0bc3
SHA256

83e1906a6bf8a25907bcbb5c82fb61b8f30b2ed04b13d5f5d9095c0785dea488
SHA512

1503dd3281ef5c0df48442bca06ebc7fdd75ce196b958f7caa5a6ebca6ea66afabca4eb48cd75720fbd3f0ba016ec8ac806d6c3d3283d17c447a62eb31755561
SSDEEP

6144:ZuOrvlGE/3VnuZBzHTlWE4vob8S61DlgWzkiBSjEq3SEOXv3pdo:Zz78EfEZJzl2vf5lgTASIqLOE

Score

1^/10

Malware Config

Signatures

Files

NEAS.839b4b0c3939e2da55fa881875939f60.exe
.dll windows:6 windows x64

dcfa0c182da14c4ed08b351e3ac34b08

Code Sign

1c:cf:9d:67:cd:e2:19:ff:12:d9:9a:ff:36:82:e5:a7
Certificate

Issuer

CN=SSL.com Root Certification Authority ECC,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

07/03/2019, 19:35

Not After

03/03/2034, 19:35

Subject

CN=SSL.com Code Signing Intermediate CA ECC R2,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7a:3f:76:65:25:a5:be:bf:50:8f:7a:5f:0b:72:2d:8e
Certificate

Issuer

CN=SSL.com Code Signing Intermediate CA ECC R2,O=SSL Corp,L=Houston,ST=Texas,C=US

Not Before

25/09/2023, 17:31

Not After

24/09/2026, 17:31

Subject

CN=Stichting Blender Foundation,O=Stichting Blender Foundation,L=Amsterdam,ST=Noord-Holland,C=NL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b
Certificate

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Not Before

09/12/2022, 18:30

Not After

06/12/2032, 18:30

Subject

CN=SSL.com Timestamping Unit 2022,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Certificate

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

13/11/2019, 18:50

Not After

12/11/2034, 18:50

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

53:8a:70:d7:21:0a:fd:dd:54:d6:02:6f:53:30:ee:1c:5a:58:36:40:da:55:69:da:93:1a:de:1b:aa:15:25:b3
Signer

Actual PE Digest

53:8a:70:d7:21:0a:fd:dd:54:d6:02:6f:53:30:ee:1c:5a:58:36:40:da:55:69:da:93:1a:de:1b:aa:15:25:b3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

python310

PyDict_GetItemWithError
PyInterpreterState_GetID
Py_GetVersion
PySet_Contains
PyObject_GetAttr
PySet_Clear
_Py_NoneStruct
PyTuple_New
PySequence_Contains
PyDict_SetItemString
PyDict_Size
PyLong_FromLongLong
PyFloat_FromDouble
PySet_Add
PyExc_AttributeError
PyTuple_GetSlice
PySet_Size
PyErr_SetString
PyIter_Next
PyErr_WriteUnraisable
PyObject_GetIter
PyNumber_Add
PyErr_WarnFormat
PyExc_ValueError
PyNumber_InPlaceLshift
PyDict_Next
PyErr_Format
PyDict_Type
PyObject_RichCompare
PyTuple_Type
_Py_FalseStruct
PyNumber_InPlaceAdd
PyFloat_Type
PyModule_NewObject
PyMethod_Type
PyLong_Type
PyType_IsSubtype
PyNumber_Subtract
PyUnicode_Join
PyExc_OverflowError
_Py_Dealloc
PyTuple_GetItem
PyImport_GetModuleDict
PyModule_GetDict
PyObject_Free
PyErr_ExceptionMatches
PyCapsule_GetPointer
PyNumber_And
PyModule_AddObject
PyObject_GC_Del
PyLong_AsLong
PyDescr_IsData
PyObject_ClearWeakRefs
PyObject_Not
PyUnicode_AsUTF8
PyUnicode_FromFormat
PySet_New
PyList_New
PyObject_GC_UnTrack
PySlice_New
PyObject_GC_IsFinalized
PyImport_AddModule
PyType_Ready
PyObject_GetAttrString
PyErr_Clear
PyList_Append
PyObject_RichCompareBool
PyUnicode_Decode
PyCode_New
PyException_SetTraceback
PyCapsule_New
_PyObject_GenericGetAttrWithDict
PySet_Type
PyDict_SetItem
PyDict_New
PyUnicode_Type
PyObject_CallFinalizerFromDealloc
_PyDict_GetItem_KnownHash
PyObject_IsInstance
PyNumber_Index
PyExc_StopIteration
PyFrozenSet_New
_PySet_NextEntry
PyList_Type
PyDict_GetItemString
PyObject_GetItem
PyModuleDef_Init
PyObject_GC_Track
PyBytes_FromStringAndSize
PyExc_NotImplementedError
PyDict_DelItem
PyUnicode_Compare
PyExc_TypeError
PyMem_Realloc
PyObject_IsTrue
PyExc_NameError
PyTuple_Pack
_PyUnicode_Ready
PyMem_Malloc
PyExc_IndexError
Py_EnterRecursiveCall
PyExc_ImportError
_Py_TrueStruct
PyExc_SystemError
PyObject_SetItem
_PyObject_GC_New
PyType_Modified
PyMethodDescr_Type
PyNumber_Or
PyUnicode_FromString
_PyType_Lookup
PyUnicode_Format
PyObject_Size
PyObject_Call
PyNumber_InPlaceSubtract
PyType_Type
PySet_Discard
PyUnicode_FromStringAndSize
_PyObject_GetDictPtr
PySet_Pop
PyObject_Hash
PyLong_FromLong
PyObject_SetAttrString
PyMethod_New
PyExc_RuntimeError
_PyThreadState_UncheckedGet
PyTraceBack_Here
PyObject_GenericGetAttr
PyList_Sort
PyNumber_Remainder
PyLong_FromSsize_t
PyErr_Occurred
PyErr_NormalizeException
PyImport_ImportModuleLevelObject
PyImport_ImportModule
Py_LeaveRecursiveCall
PyExc_KeyError
_PyDict_SetItem_KnownHash
PyExc_DeprecationWarning
PyLong_AsSsize_t
PyFrame_New
PyFunction_Type
PyErr_PrintEx
PyErr_WarnEx
PyErr_GivenExceptionMatches
PyCode_NewEmpty
PyErr_SetObject
PyThreadState_Get
PyOS_snprintf
PyCFunction_Type
PyUnicode_InternFromString
PyObject_SetAttr
PyBaseObject_Type
PyNumber_InPlaceOr
PySequence_List
PyNumber_Invert
PyFrozenSet_Type

kernel32

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
IsDebuggerPresent
InitializeSListHead

vcruntime140

memset
__C_specific_handler
__std_type_info_destroy_list
memcmp

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initterm
_execute_onexit_table
_cexit
_initialize_onexit_table

Exports

Exports

PyInit_FlowControl

Sections

.text
Size: 287KB - Virtual size: 287KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dcfa0c182da14c4ed08b351e3ac34b08

Code Sign

1c:cf:9d:67:cd:e2:19:ff:12:d9:9a:ff:36:82:e5:a7Certificate

Extended Key Usages

Key Usages

7a:3f:76:65:25:a5:be:bf:50:8f:7a:5f:0b:72:2d:8eCertificate

Extended Key Usages

Key Usages

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4bCertificate

Extended Key Usages

Key Usages

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56Certificate

Extended Key Usages

Key Usages

53:8a:70:d7:21:0a:fd:dd:54:d6:02:6f:53:30:ee:1c:5a:58:36:40:da:55:69:da:93:1a:de:1b:aa:15:25:b3Signer

Headers

DLL Characteristics

File Characteristics

Imports

python310

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 287KB - Virtual size: 287KB

.rdata Size: 43KB - Virtual size: 42KB

.data Size: 34KB - Virtual size: 42KB

.pdata Size: 6KB - Virtual size: 6KB

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 3KB - Virtual size: 3KB

1c:cf:9d:67:cd:e2:19:ff:12:d9:9a:ff:36:82:e5:a7
Certificate

7a:3f:76:65:25:a5:be:bf:50:8f:7a:5f:0b:72:2d:8e
Certificate

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b
Certificate

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Certificate

53:8a:70:d7:21:0a:fd:dd:54:d6:02:6f:53:30:ee:1c:5a:58:36:40:da:55:69:da:93:1a:de:1b:aa:15:25:b3
Signer

.text
Size: 287KB - Virtual size: 287KB

.rdata
Size: 43KB - Virtual size: 42KB

.data
Size: 34KB - Virtual size: 42KB

.pdata
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 3KB - Virtual size: 3KB