NEAS[.]5fe042c0923c220cd9f1edcbf39a54d0_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.5fe042c0923c220cd9f1edcbf39a54d0_JC.exe
Size

9.6MB
MD5

5fe042c0923c220cd9f1edcbf39a54d0
SHA1

3f1b9f1524121ab7446b8ddc540e5fa40d9506a5
SHA256

ca3f812a1f744ba47870813b8767ee525bcdc0e9fdf1a728c3ae256a5e50ea22
SHA512

8a01388a7c48a4e70e4e1571817bec7e852a369854d2ad2a5626cb2a30830a88978c2783d040a87403677b7990d65278029a6ad3b1e9adf5d0bf74d4895c4ae2
SSDEEP

196608:98T0zYYQafWAgJ8deNx2raDRg8QamniaF2bSm/J365fEoNTHbNSs15IvqF8J3y1Y:99LuAc8ENxKaD4bi4m/J365rTH/fFI3F

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
sample	aspack_v212_v242

Files

NEAS.5fe042c0923c220cd9f1edcbf39a54d0_JC.exe
.exe windows:5 windows x86

Code Sign

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

08/03/2016, 13:10

Not After

30/05/2027, 13:10

Subject

CN=Certum EV TSA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29/10/2015, 11:30

Not After

09/06/2027, 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:3f:8e:be:ce:86:be:c2:75:4b:15:54:c2:2f:80:cf
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

15/01/2016, 13:00

Not After

06/04/2018, 09:13

Subject

CN=Biuro Informatyki Stosowanej FORMAT,O=Biuro Informatyki Stosowanej FORMAT,C=PL,1.2.840.113549.1.9.1=#0c15666f726d617440666f726d61742e77726f632e706c

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7e:36:61:50:6a:89:6c:09:f2:35:b3:cd:56:2f:d6:20:23:72:0d:5c
Signer

Actual PE Digest

7e:36:61:50:6a:89:6c:09:f2:35:b3:cd:56:2f:d6:20:23:72:0d:5c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

.text
Size: 1.9MB - Virtual size: 6.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.itext
Size: 33KB - Virtual size: 172KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 36KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 872KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: - Virtual size: 404KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7.6MB - Virtual size: 22.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 36KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70Certificate

Extended Key Usages

Key Usages

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2Certificate

Extended Key Usages

Key Usages

5f:3f:8e:be:ce:86:be:c2:75:4b:15:54:c2:2f:80:cfCertificate

Extended Key Usages

Key Usages

7e:36:61:50:6a:89:6c:09:f2:35:b3:cd:56:2f:d6:20:23:72:0d:5cSigner

Headers

File Characteristics

Sections

.text Size: 1.9MB - Virtual size: 6.9MB

.itext Size: 33KB - Virtual size: 172KB

.data Size: 36KB - Virtual size: 116KB

.bss Size: - Virtual size: 872KB

.idata Size: 6KB - Virtual size: 20KB

.tls Size: - Virtual size: 4KB

.rdata Size: 512B - Virtual size: 4KB

.reloc Size: - Virtual size: 404KB

.rsrc Size: 7.6MB - Virtual size: 22.6MB

.aspack Size: 36KB - Virtual size: 40KB

.adata Size: - Virtual size: 4KB

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

5f:3f:8e:be:ce:86:be:c2:75:4b:15:54:c2:2f:80:cf
Certificate

7e:36:61:50:6a:89:6c:09:f2:35:b3:cd:56:2f:d6:20:23:72:0d:5c
Signer

.text
Size: 1.9MB - Virtual size: 6.9MB

.itext
Size: 33KB - Virtual size: 172KB

.data
Size: 36KB - Virtual size: 116KB

.bss
Size: - Virtual size: 872KB

.idata
Size: 6KB - Virtual size: 20KB

.tls
Size: - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 4KB

.reloc
Size: - Virtual size: 404KB

.rsrc
Size: 7.6MB - Virtual size: 22.6MB

.aspack
Size: 36KB - Virtual size: 40KB

.adata
Size: - Virtual size: 4KB