NEAS[.]3c6205f5f4900b8ec5af95c937719450_JC[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.3c6205f5f4900b8ec5af95c937719450_JC.exe
Size

178KB
MD5

3c6205f5f4900b8ec5af95c937719450
SHA1

53ace7a77aff685e2be6a06ab1f7db8884589f79
SHA256

9b62ee7588665872ffe6010002eb1aedff92a06fc5562d357a0492d9330e096d
SHA512

fc6a5d75c3cb9df6f6c607ff1167029930d333dd327711c1833e08f094faa064616e4ac921e47a556d7e96f671e49fc0a8667b7ee1b8f348aa92776e7ef4ae91
SSDEEP

3072:mXgK0gUfQE4kMXJim26Vyy212KrcHwvTfInNlqU4JTc1C+GTssY/1pqAxhb:mQKNUfQE4/ifNj6xDC41CdbY/Xrb

Score

1^/10

Malware Config

Signatures

Files

NEAS.3c6205f5f4900b8ec5af95c937719450_JC.exe
.dll windows:6 windows x64

72dac28481188e62c1c46eb31f00b666

Code Sign

33:00:00:00:4c:a1:e8:4d:cc:b4:74:7b:3b:00:00:00:00:00:4c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/11/2013, 22:11

Not After

11/02/2015, 22:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/04/2014, 17:39

Not After

22/07/2015, 17:39

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:33:56:f6:94:1d:9a:8c:bd:e5:00:00:00:00:00:33
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/09/2013, 17:35

Not After

24/12/2014, 17:35

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d5:28:27:9f:6b:77:ac:ee:39:fa:7c:40:4f:2a:e2:7b:63:2d:fe:be:e7:0a:0b:70:02:86:27:8f:0d:0a:92:24
Signer

Actual PE Digest

d5:28:27:9f:6b:77:ac:ee:39:fa:7c:40:4f:2a:e2:7b:63:2d:fe:be:e7:0a:0b:70:02:86:27:8f:0d:0a:92:24

Digest Algorithm

sha256

PE Digest Matches

true

6f:4d:32:ad:41:9c:df:f8:f6:22:fe:57:28:70:9e:67:4e:cd:31:c3
Signer

Actual PE Digest

6f:4d:32:ad:41:9c:df:f8:f6:22:fe:57:28:70:9e:67:4e:cd:31:c3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_onexit
_lock
__dllonexit
_unlock
??1type_info@@UEAA@XZ
memset
memcpy
__C_specific_handler
_amsg_exit
_initterm
_XcptFilter
_callnewh
malloc
_CxxThrowException
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
wcschr
_vsnprintf
_purecall
towupper
realloc
free
memmove
_vsnwprintf
__CxxFrameHandler
ceilf

advapi32

RegOpenKeyExA
RegQueryValueExA
RevertToSelf
ImpersonateLoggedOnUser
RegQueryValueExW
GetSecurityDescriptorOwner
RegCreateKeyExW
SetNamedSecurityInfoW
GetSecurityDescriptorDacl
RegSetValueExW
RegCloseKey
GetTokenInformation
OpenProcessToken
RegDeleteValueW
ConvertSidToStringSidW
RegOpenKeyExW
RegEnumValueW
RegQueryInfoKeyW
ConvertStringSecurityDescriptorToSecurityDescriptorW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceEvent

user32

PeekMessageW
DispatchMessageW
GetSystemMetrics
MsgWaitForMultipleObjects
TranslateMessage

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetThreadLocale
CreateMutexW
OpenMutexW
GetVersionExW
GetLongPathNameW
GetFileSizeEx
ExpandEnvironmentStringsW
WaitForSingleObject
GetTempPathW
CreateDirectoryW
SetThreadPriority
SetFilePointerEx
lstrlenW
GlobalFree
CompareStringW
GetSystemTimeAsFileTime
GetThreadPriority
SetErrorMode
GetModuleHandleA
OpenEventA
GetVersionExA
DelayLoadFailureHook
ReleaseMutex
GetFileAttributesW
WaitForMultipleObjects
GetCurrentThread
GetTempFileNameW
FileTimeToDosDateTime
OpenFileMappingW
VirtualAlloc
WriteFile
VirtualFree
ResetEvent
CreateThread
FreeLibraryAndExitThread
DuplicateHandle
CreateEventW
GetFileSize
ReadFile
SetEvent
GetFileAttributesExW
CompareFileTime
FindNextFileW
GetCurrentProcess
FindClose
GetModuleFileNameW
LocalAlloc
LocalFree
LoadLibraryW
GetTickCount
FreeLibrary
DisableThreadLibraryCalls
LoadLibraryA
VirtualProtect
Sleep
GetSystemTime
CreateFileW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetLastError
SetLastError
CloseHandle
LeaveCriticalSection
SystemTimeToFileTime
EnterCriticalSection
FindFirstFileW
DeleteFileW
GetProcAddress

Exports

Exports

SqmAddToAverage
SqmAddToStream
SqmAddToStreamDWord
SqmAddToStreamString
SqmAddToStreamV
SqmCleanup
SqmClearFlags
SqmCreateNewId
SqmEndSession
SqmFlushSession
SqmGetEnabled
SqmGetFlags
SqmGetMachineId
SqmGetSession
SqmGetSessionStartTime
SqmGetUserId
SqmIncrement
SqmIsWindowsOptedIn
SqmReadSharedMachineId
SqmReadSharedUserId
SqmSet
SqmSetAppId
SqmSetAppVersion
SqmSetBits
SqmSetBool
SqmSetCurrentTimeAsUploadTime
SqmSetEnabled
SqmSetFlags
SqmSetIfMax
SqmSetIfMin
SqmSetMachineId
SqmSetString
SqmSetUserId
SqmStartSession
SqmStartUpload
SqmSysprepGeneralize
SqmSysprepSpecialize
SqmTimerAccumulate
SqmTimerAddToAverage
SqmTimerRecord
SqmTimerStart
SqmUnattendedSetup
SqmWaitForUploadComplete
SqmWriteSharedMachineId
SqmWriteSharedUserId

Sections

.text
Size: 151KB - Virtual size: 151KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

72dac28481188e62c1c46eb31f00b666

Code Sign

33:00:00:00:4c:a1:e8:4d:cc:b4:74:7b:3b:00:00:00:00:00:4cCertificate

Extended Key Usages

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:caCertificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:00:33:56:f6:94:1d:9a:8c:bd:e5:00:00:00:00:00:33Certificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

d5:28:27:9f:6b:77:ac:ee:39:fa:7c:40:4f:2a:e2:7b:63:2d:fe:be:e7:0a:0b:70:02:86:27:8f:0d:0a:92:24Signer

6f:4d:32:ad:41:9c:df:f8:f6:22:fe:57:28:70:9e:67:4e:cd:31:c3Signer

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

advapi32

user32

kernel32

Exports

Exports

Sections

.text Size: 151KB - Virtual size: 151KB

.data Size: 4KB - Virtual size: 5KB

.pdata Size: 5KB - Virtual size: 4KB

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 1024B - Virtual size: 936B

33:00:00:00:4c:a1:e8:4d:cc:b4:74:7b:3b:00:00:00:00:00:4c
Certificate

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:33:56:f6:94:1d:9a:8c:bd:e5:00:00:00:00:00:33
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

d5:28:27:9f:6b:77:ac:ee:39:fa:7c:40:4f:2a:e2:7b:63:2d:fe:be:e7:0a:0b:70:02:86:27:8f:0d:0a:92:24
Signer

6f:4d:32:ad:41:9c:df:f8:f6:22:fe:57:28:70:9e:67:4e:cd:31:c3
Signer

.text
Size: 151KB - Virtual size: 151KB

.data
Size: 4KB - Virtual size: 5KB

.pdata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 1024B - Virtual size: 936B