NEAS[.]b65d241b81a010b6a78cceea900ccfc0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.b65d241b81a010b6a78cceea900ccfc0.exe
Size

55KB
MD5

b65d241b81a010b6a78cceea900ccfc0
SHA1

5a157321146f566c1abb98dec91021d26210ee3a
SHA256

83d10eb26480bbb300a0632d45a20811f87cf0b34c0cd6ce773074910293e92b
SHA512

46d82a1ea4e5099ba12c4ca22a2bb81b5cfab68e4667e8c0a0689a26374815be548b7019ddcd33e20d6691048f76d5e0cb4cc5340c13d84d05927091ba0fc451
SSDEEP

1536:QJKsdF731MbIi2p33FR4lr7UIhJpPGElAPD2w:zsIp29slrpnpOElA7/

Score

1^/10

Malware Config

Signatures

Files

NEAS.b65d241b81a010b6a78cceea900ccfc0.exe
.dll windows:10 windows x86

ee0d292f4f13eb397701132a65ef1a44

Code Sign

33:00:00:00:bc:e1:20:fd:d2:7c:c8:ee:93:00:00:00:00:00:bc
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/08/2015, 17:15

Not After

18/11/2016, 17:15

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

df:0b:34:de:d2:0f:cd:41:ca:dd:56:e4:9d:9a:84:9c:99:c2:2d:e0:ce:43:72:28:85:ab:61:72:79:60:4a:12
Signer

Actual PE Digest

df:0b:34:de:d2:0f:cd:41:ca:dd:56:e4:9d:9a:84:9c:99:c2:2d:e0:ce:43:72:28:85:ab:61:72:79:60:4a:12

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

wcsncpy_s
memcpy
_itow_s
??3@YAXPAX@Z
??1type_info@@UAE@XZ
isdigit
strchr
_wcsnicmp
strcpy_s
__RTDynamicCast
_except_handler4_common
_initterm
malloc
wcscat_s
free
_amsg_exit
_XcptFilter
wcscpy_s
_wcsicmp
memset

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
LoadLibraryExW
GetProcAddress
FreeLibrary

bcrypt

BCryptEncrypt
BCryptDestroyHash
BCryptHashData
BCryptDestroyKey
BCryptGenerateSymmetricKey
BCryptFinishHash
BCryptCreateHash

rpcrt4

RpcStringBindingComposeW
RpcBindingFree
RpcStringFreeW
I_RpcExceptionFilter
NdrClientCall4
RpcBindingFromStringBindingW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalReAlloc
LocalAlloc

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-sysinfo-l1-2-1

GetComputerNameExW
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-errorhandling-l1-1-1

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

ntdll

NlsMbOemCodePageTag
RtlxUnicodeStringToOemSize
NtFsControlFile
NtOpenThreadToken
NtSetInformationThread
NtCreateFile
NtImpersonateAnonymousToken
RtlUnicodeToOemN
RtlInitAnsiString
RtlNtStatusToDosError
RtlReleaseResource
RtlDeleteResource
RtlAcquireResourceExclusive
RtlGetLastNtStatus
RtlInitializeResource
NtClose
RtlRunEncodeUnicodeString
RtlInitUnicodeString
RtlOemStringToUnicodeString

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

Exports

Exports

NetAddAlternateComputerName
NetEnumerateComputerNames
NetGetJoinInformation
NetGetJoinableOUs
NetJoinDomain
NetRemoveAlternateComputerName
NetRenameMachineInDomain
NetSetPrimaryComputerName
NetUnjoinDomain
NetUseAdd
NetUseDel
NetUseEnum
NetUseGetInfo
NetValidateName
NetWkstaGetInfo
NetWkstaSetInfo
NetWkstaStatisticsGet
NetWkstaTransportAdd
NetWkstaTransportDel
NetWkstaTransportEnum
NetWkstaUserEnum
NetWkstaUserGetInfo
NetWkstaUserSetInfo

Sections

.text
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ee0d292f4f13eb397701132a65ef1a44

Code Sign

33:00:00:00:bc:e1:20:fd:d2:7c:c8:ee:93:00:00:00:00:00:bcCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

df:0b:34:de:d2:0f:cd:41:ca:dd:56:e4:9d:9a:84:9c:99:c2:2d:e0:ce:43:72:28:85:ab:61:72:79:60:4a:12Signer

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

bcrypt

rpcrt4

api-ms-win-core-heap-l2-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-apiquery-l1-1-0

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-timezone-l1-1-0

Exports

Exports

Sections

.text Size: 37KB - Virtual size: 37KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 3KB - Virtual size: 2KB

.didat Size: 512B - Virtual size: 84B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

33:00:00:00:bc:e1:20:fd:d2:7c:c8:ee:93:00:00:00:00:00:bc
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

df:0b:34:de:d2:0f:cd:41:ca:dd:56:e4:9d:9a:84:9c:99:c2:2d:e0:ce:43:72:28:85:ab:61:72:79:60:4a:12
Signer

.text
Size: 37KB - Virtual size: 37KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 3KB - Virtual size: 2KB

.didat
Size: 512B - Virtual size: 84B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB