NEAS[.]3a4df1256969a1e9cb4d7c9ea7e98fd0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.3a4df1256969a1e9cb4d7c9ea7e98fd0.exe
Size

150KB
MD5

3a4df1256969a1e9cb4d7c9ea7e98fd0
SHA1

4f9575d1b1ef70722debf3ba82c6f086a6c0e575
SHA256

dc4f263723a38b0b89db088b7a21a6f73dee0b575c99c50f32ad201829c5fcea
SHA512

d8e12f712ea3ca2e366ab8543d99522f7d2ad1fe396b5c447ffc9fbbb9c39bc7353f57823aca52bd7fa206515bc548e0a8736139dacab8b5b22c68b633b94d94
SSDEEP

1536:Zcag0KukLZ3DWGX/pkhVuLJeV2nToIfSIOggIORj5fdk4w/ZKa3hW:lGFDWkKuteViTBfwgW1Jn

Score

1^/10

Malware Config

Signatures

Files

NEAS.3a4df1256969a1e9cb4d7c9ea7e98fd0.exe
.dll windows:5 windows x64

e2743749fb53e167b4734269f1570e87

Code Sign

04
Certificate

Issuer

CN=AC Root CA

Not Before

26/01/2023, 00:00

Not After

25/01/2043, 23:59

Subject

CN=AC Game 3rd Party CS CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06
Certificate

Issuer

CN=AC Game 3rd Party CS CA

Not Before

31/03/2023, 00:00

Not After

30/03/2028, 23:59

Subject

CN=AC Warface 3rd Party

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

97:11:7a:9a:79:cc:1b:e3:c3:e8:b6:7f:1b:0a:48:91:05:3e:3f:d8:ea:42:e4:2a:5b:ed:92:c8:cd:6f:9c:73
Signer

Actual PE Digest

97:11:7a:9a:79:cc:1b:e3:c3:e8:b6:7f:1b:0a:48:91:05:3e:3f:d8:ea:42:e4:2a:5b:ed:92:c8:cd:6f:9c:73

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

InitOnceExecuteOnce
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW

vcruntime140

__current_exception_context
memcpy
memset
__C_specific_handler
memchr
__current_exception
__std_type_info_destroy_list

api-ms-win-crt-stdio-l1-1-0

_open
_lseeki64
_wopen
__stdio_common_vsprintf
_write
_read
_close

api-ms-win-crt-heap-l1-1-0

free
malloc

api-ms-win-crt-convert-l1-1-0

wcstombs

api-ms-win-crt-runtime-l1-1-0

terminate
_errno
_cexit
_register_onexit_function
_crt_atexit
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
strerror
_execute_onexit_table
_crt_at_quick_exit
_initialize_onexit_table

Exports

Exports

Cr_z_adler32
Cr_z_adler32_combine
Cr_z_adler32_z
Cr_z_compress
Cr_z_compress2
Cr_z_compressBound
Cr_z_crc32
Cr_z_crc32_combine
Cr_z_crc32_z
Cr_z_deflate
Cr_z_deflateBound
Cr_z_deflateCopy
Cr_z_deflateEnd
Cr_z_deflateGetDictionary
Cr_z_deflateInit2_
Cr_z_deflateInit_
Cr_z_deflateParams
Cr_z_deflatePending
Cr_z_deflatePrime
Cr_z_deflateReset
Cr_z_deflateResetKeep
Cr_z_deflateSetDictionary
Cr_z_deflateSetHeader
Cr_z_deflateTune
Cr_z_get_crc_table
Cr_z_gzbuffer
Cr_z_gzclearerr
Cr_z_gzclose
Cr_z_gzclose_r
Cr_z_gzclose_w
Cr_z_gzdirect
Cr_z_gzdopen
Cr_z_gzeof
Cr_z_gzerror
Cr_z_gzflush
Cr_z_gzfread
Cr_z_gzfwrite
Cr_z_gzgetc
Cr_z_gzgetc_
Cr_z_gzgets
Cr_z_gzoffset
Cr_z_gzoffset64
Cr_z_gzopen
Cr_z_gzopen64
Cr_z_gzopen_w
Cr_z_gzprintf
Cr_z_gzputc
Cr_z_gzputs
Cr_z_gzread
Cr_z_gzrewind
Cr_z_gzseek
Cr_z_gzseek64
Cr_z_gzsetparams
Cr_z_gztell
Cr_z_gztell64
Cr_z_gzungetc
Cr_z_gzvprintf
Cr_z_gzwrite
Cr_z_inflate
Cr_z_inflateBack
Cr_z_inflateBackEnd
Cr_z_inflateBackInit_
Cr_z_inflateCodesUsed
Cr_z_inflateCopy
Cr_z_inflateEnd
Cr_z_inflateGetDictionary
Cr_z_inflateGetHeader
Cr_z_inflateInit2_
Cr_z_inflateInit_
Cr_z_inflateMark
Cr_z_inflatePrime
Cr_z_inflateReset
Cr_z_inflateReset2
Cr_z_inflateResetKeep
Cr_z_inflateSetDictionary
Cr_z_inflateSync
Cr_z_inflateSyncPoint
Cr_z_inflateUndermine
Cr_z_inflateValidate
Cr_z_uncompress
Cr_z_uncompress2
Cr_z_zError
Cr_z_zlibCompileFlags
Cr_z_zlibVersion

Sections

.text
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 337B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 662B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e2743749fb53e167b4734269f1570e87

Code Sign

04Certificate

Extended Key Usages

Key Usages

06Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

97:11:7a:9a:79:cc:1b:e3:c3:e8:b6:7f:1b:0a:48:91:05:3e:3f:d8:ea:42:e4:2a:5b:ed:92:c8:cd:6f:9c:73Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 98KB - Virtual size: 98KB

.rdata Size: 34KB - Virtual size: 33KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 3KB - Virtual size: 3KB

.idata Size: 3KB - Virtual size: 3KB

.gfids Size: 1KB - Virtual size: 1KB

.00cfg Size: 512B - Virtual size: 337B

.reloc Size: 1024B - Virtual size: 662B

04
Certificate

06
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

97:11:7a:9a:79:cc:1b:e3:c3:e8:b6:7f:1b:0a:48:91:05:3e:3f:d8:ea:42:e4:2a:5b:ed:92:c8:cd:6f:9c:73
Signer

.text
Size: 98KB - Virtual size: 98KB

.rdata
Size: 34KB - Virtual size: 33KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 3KB - Virtual size: 3KB

.idata
Size: 3KB - Virtual size: 3KB

.gfids
Size: 1KB - Virtual size: 1KB

.00cfg
Size: 512B - Virtual size: 337B

.reloc
Size: 1024B - Virtual size: 662B