NEAS[.]9351649f03b94d8388067cda9b7bd890[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.9351649f03b94d8388067cda9b7bd890.exe
Size

729KB
MD5

9351649f03b94d8388067cda9b7bd890
SHA1

4eb816952b8c87623158388fed1ddfcbbfdcc322
SHA256

02d9b60fc5b505eda0eb1a18cc05b0d5cfd5fbddfd7a7402779544ccf6a8feb6
SHA512

61ed8d2452cc7ca1d80ca533b6c4709a5373cca7690ac512ba21190a703d33efc5fa0b8c47d39cdd5757c1dca08e29cdb6579747c77f3e5dfa77fd1354bcbdd0
SSDEEP

6144:OSKhuThtlHuKi8vSbY1HqoN00AqJF6QCojAOKAOLTJUkFhmxTB7drI/7gkzKTr6Y:qhuThtlHupZZ800ZCFojQXKv6gQu+6

Score

1^/10

Malware Config

Signatures

Files

NEAS.9351649f03b94d8388067cda9b7bd890.exe
.exe windows:6 windows x86

c050decace92a6ffab6c67ea82c9d93b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

30/09/2010, 00:00

Not After

01/01/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4c:d9:e7:55:85:0c:13:72:b4:8d:c1:82:a7:30:8b:ab
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

03/04/2013, 00:00

Not After

01/06/2016, 23:59

Subject

CN=Advanced Micro Devices\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Advanced Micro Devices\, Inc.,L=Sunnyvale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b3:a6:eb:3d:53:be:d3:17:c6:1f:61:c5:1e:a7:2c:20:55:b6:8a:12
Signer

Actual PE Digest

b3:a6:eb:3d:53:be:d3:17:c6:1f:61:c5:1e:a7:2c:20:55:b6:8a:12

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

psapi

EnumProcesses

kernel32

CreateEventA
SetEvent
GetTickCount
GlobalAddAtomA
GlobalDeleteAtom
SetLastError
FindFirstFileW
GetLocaleInfoW
LoadLibraryW
GetACP
ReadConsoleW
ReadFile
FlushFileBuffers
WriteConsoleW
SetStdHandle
GetTimeZoneInformation
SetFilePointerEx
GetLastError
GetConsoleCP
GetStringTypeW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LCMapStringW
CompareStringW
HeapReAlloc
RtlUnwind
OutputDebugStringW
LoadLibraryExW
LeaveCriticalSection
EnterCriticalSection
FreeEnvironmentStringsW
CreateProcessW
GetTickCount64
CloseHandle
QueryFullProcessImageNameA
OpenProcess
GetVersionExA
Sleep
OutputDebugStringA
FreeLibrary
GetProcAddress
LoadLibraryA
CreateFileW
GetConsoleMode
EncodePointer
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
DeleteCriticalSection
GetFileType
GetModuleHandleW
HeapAlloc
HeapFree
SetEnvironmentVariableA
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
WideCharToMultiByte
MultiByteToWideChar
FindFirstFileExW
FindClose
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetCommandLineA
InterlockedDecrement
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
GetProcessHeap
RaiseException
InterlockedIncrement
GetCurrentThreadId
HeapSize
IsValidCodePage
GetOEMCP
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW

user32

wsprintfA
SetTimer
LoadStringW
DestroyMenu
TrackPopupMenu
SetMenuDefaultItem
InsertMenuW
GetCursorPos
CreatePopupMenu
SetForegroundWindow
LoadImageW
UnregisterHotKey
RegisterHotKey
CreateWindowExA
RegisterClassExA
LoadCursorA
LoadIconA
DefWindowProcA
SendMessageA
PostQuitMessage
IsWindow
FindWindowW
MessageBoxExA
DestroyWindow
KillTimer
GetMessageA

advapi32

RegSetValueExW
RegDeleteValueW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumValueW
RegQueryValueExW
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExW
RegSetValueExA
RegCreateKeyExA
RegEnumKeyExW

shell32

SHGetSpecialFolderLocation
SHBindToParent
Shell_NotifyIconW
SHGetMalloc

ole32

CoInitialize
CoUninitialize
CoCreateInstance

Sections

.text
Size: 295KB - Virtual size: 295KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 89KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 286KB - Virtual size: 285KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c050decace92a6ffab6c67ea82c9d93b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4Certificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

4c:d9:e7:55:85:0c:13:72:b4:8d:c1:82:a7:30:8b:abCertificate

Extended Key Usages

Key Usages

b3:a6:eb:3d:53:be:d3:17:c6:1f:61:c5:1e:a7:2c:20:55:b6:8a:12Signer

Headers

DLL Characteristics

File Characteristics

Imports

psapi

kernel32

user32

advapi32

shell32

ole32

Sections

.text Size: 295KB - Virtual size: 295KB

.rdata Size: 89KB - Virtual size: 88KB

.data Size: 8KB - Virtual size: 17KB

.rsrc Size: 286KB - Virtual size: 285KB

.reloc Size: 42KB - Virtual size: 42KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

4c:d9:e7:55:85:0c:13:72:b4:8d:c1:82:a7:30:8b:ab
Certificate

b3:a6:eb:3d:53:be:d3:17:c6:1f:61:c5:1e:a7:2c:20:55:b6:8a:12
Signer

.text
Size: 295KB - Virtual size: 295KB

.rdata
Size: 89KB - Virtual size: 88KB

.data
Size: 8KB - Virtual size: 17KB

.rsrc
Size: 286KB - Virtual size: 285KB

.reloc
Size: 42KB - Virtual size: 42KB