NEAS[.]6fae425f7e27c6ff217266b40c83f160_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.6fae425f7e27c6ff217266b40c83f160_JC.exe
Size

1.2MB
MD5

6fae425f7e27c6ff217266b40c83f160
SHA1

4b0af8bb4b2313682af44c4d72aec4069ebec51e
SHA256

e6f970bc9ee1965a1ca4a349b8fc19a40b72ade59a8dfb0b02c9f303f437f444
SHA512

3befd1ba9c29181652633d6ebbd70f8166dc25923c643b514622d040d2de873dd6fa82e5e1369a60bd077faff83c7df588073fca11e820c4b1e4b56bc3e6a4ad
SSDEEP

24576:c1m5kQXi805iYyNoxXNpVJsYHg5SGAQlDE+QP00/Thtr9fDxW5M:jyyy/TsYHg5SGAQlDE+QP00/ThV9rkM

Score

1^/10

Malware Config

Signatures

Files

NEAS.6fae425f7e27c6ff217266b40c83f160_JC.exe
.dll windows:6 windows

e5c6e67b5088284f3c82fe11ef01b795

Code Sign

33:00:00:00:7b:a2:81:0b:87:11:ab:e7:fc:00:00:00:00:00:7b
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/10/2014, 18:06

Not After

01/01/2016, 18:06

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:42:2d:3c:b3:87:33:fe:3a:c8:00:00:00:00:00:42
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/12/2014, 18:42

Not After

19/03/2016, 18:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

eb:18:db:a7:20:81:c4:e8:ae:07:ec:8a:04:7d:78:fc:3d:c5:25:10:bb:37:e6:7e:84:cd:a8:f9:63:eb:8e:79
Signer

Actual PE Digest

eb:18:db:a7:20:81:c4:e8:ae:07:ec:8a:04:7d:78:fc:3d:c5:25:10:bb:37:e6:7e:84:cd:a8:f9:63:eb:8e:79

Digest Algorithm

sha256

PE Digest Matches

true

eb:18:db:a7:20:81:c4:e8:ae:07:ec:8a:04:7d:78:fc:3d:c5:25:10:bb:37:e6:7e:84:cd:a8:f9:63:eb:8e:79
Signer

Actual PE Digest

eb:18:db:a7:20:81:c4:e8:ae:07:ec:8a:04:7d:78:fc:3d:c5:25:10:bb:37:e6:7e:84:cd:a8:f9:63:eb:8e:79

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

qsort
strcat_s
sprintf_s
_unlock
wcscat_s
strchr
_XcptFilter
_amsg_exit
_initterm
wcstoul
_vsnwprintf_s
__C_specific_handler
_errno
memmove
strncpy_s
wcsncat_s
strrchr
strncat_s
malloc
free
_snwprintf_s
??1type_info@@UAA@XZ
_vsnprintf_s
memcmp
_purecall
?terminate@@YAXXZ
_onexit
_lock
memcpy
__dllonexit
_snprintf_s
wcscpy_s
wcsstr
_wcslwr_s
_vsnwprintf
wcsncpy_s
strnlen
memcpy_s
strcmp
wcschr
strcpy_s
_CxxThrowException
__CxxFrameHandler3
memchr
memset
strncmp
wcscmp
wcslen
wcsncmp
strlen

api-ms-win-core-synch-l1-2-0

CreateEventW
ResetEvent
ReleaseSemaphore
WaitForSingleObjectEx
ReleaseMutex
SetEvent
CreateSemaphoreExW
CreateMutexW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
Sleep
SleepEx
InitializeCriticalSection

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-errorhandling-l1-1-1

SetLastError
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
GetLastError

api-ms-win-core-processenvironment-l1-2-0

GetEnvironmentVariableW
GetEnvironmentVariableA

api-ms-win-core-libraryloader-l1-1-1

FreeLibrary
GetProcAddress
GetModuleHandleW
LoadStringW

oleaut32

CreateErrorInfo
SetErrorInfo

api-ms-win-core-sysinfo-l1-2-0

GetSystemInfo

api-ms-win-core-memory-l1-1-1

MapViewOfFile
VirtualFree
UnmapViewOfFile
VirtualAlloc
CreateFileMappingW
VirtualQuery
ReadProcessMemory
VirtualProtect

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-debug-l1-1-1

DebugBreak

api-ms-win-core-processthreads-l1-1-1

TlsGetValue
TlsAlloc
GetCurrentProcess
TlsSetValue
TerminateProcess
SwitchToThread
TlsFree

api-ms-win-core-heap-l1-2-0

HeapAlloc
HeapValidate
HeapCreate
GetProcessHeap
HeapFree
HeapDestroy

api-ms-win-core-localization-l1-2-0

GetACP
IsDBCSLeadByte
LCMapStringEx
FormatMessageW
GetCPInfo

api-ms-win-core-file-l1-2-0

SetFilePointer
CreateFileW
FlushFileBuffers
WriteFile
ReadFile
GetFileAttributesExW

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

api-ms-win-core-com-l1-1-0

CoCreateGuid
CoTaskMemFree
CoCreateFreeThreadedMarshaler
IIDFromString

api-ms-win-core-rtlsupport-l1-2-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree

Exports

Exports

CLRDataCreateInstance
DacDbiInterfaceInstance
OutOfProcessExceptionEventCallback
OutOfProcessExceptionEventDebuggerLaunchCallback
OutOfProcessExceptionEventSignatureCallback
OutOfProcessFunctionTableCallback
OutOfProcessFunctionTableCallbackEx

Sections

.text
Size: 749KB - Virtual size: 749KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 355KB - Virtual size: 354KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e5c6e67b5088284f3c82fe11ef01b795

Code Sign

33:00:00:00:7b:a2:81:0b:87:11:ab:e7:fc:00:00:00:00:00:7bCertificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

33:00:00:00:42:2d:3c:b3:87:33:fe:3a:c8:00:00:00:00:00:42Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

eb:18:db:a7:20:81:c4:e8:ae:07:ec:8a:04:7d:78:fc:3d:c5:25:10:bb:37:e6:7e:84:cd:a8:f9:63:eb:8e:79Signer

eb:18:db:a7:20:81:c4:e8:ae:07:ec:8a:04:7d:78:fc:3d:c5:25:10:bb:37:e6:7e:84:cd:a8:f9:63:eb:8e:79Signer

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-synch-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-libraryloader-l1-1-1

oleaut32

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-memory-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-heap-obsolete-l1-1-0

Exports

Exports

Sections

.text Size: 749KB - Virtual size: 749KB

.rdata Size: 355KB - Virtual size: 354KB

.data Size: 7KB - Virtual size: 29KB

.pdata Size: 31KB - Virtual size: 31KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 25KB - Virtual size: 24KB

33:00:00:00:7b:a2:81:0b:87:11:ab:e7:fc:00:00:00:00:00:7b
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

33:00:00:00:42:2d:3c:b3:87:33:fe:3a:c8:00:00:00:00:00:42
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

eb:18:db:a7:20:81:c4:e8:ae:07:ec:8a:04:7d:78:fc:3d:c5:25:10:bb:37:e6:7e:84:cd:a8:f9:63:eb:8e:79
Signer

eb:18:db:a7:20:81:c4:e8:ae:07:ec:8a:04:7d:78:fc:3d:c5:25:10:bb:37:e6:7e:84:cd:a8:f9:63:eb:8e:79
Signer

.text
Size: 749KB - Virtual size: 749KB

.rdata
Size: 355KB - Virtual size: 354KB

.data
Size: 7KB - Virtual size: 29KB

.pdata
Size: 31KB - Virtual size: 31KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 25KB - Virtual size: 24KB