NEAS[.]ad37b56d53795944240011ff4eebbd30_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.ad37b56d53795944240011ff4eebbd30_JC.exe
Size

890KB
MD5

ad37b56d53795944240011ff4eebbd30
SHA1

44011066e03ccf792a24a7cdba170c1c1032b45b
SHA256

b3fef980181f7c10f6d47d9214740321bb66cead1a71f9fcf991621415448906
SHA512

85be2d1dfa828c390b7b2bf25bc50b8d7226112bf36c791788e88518052f8f73326990a82e6870ac9cb2980a9fb028395ed8cda20cc95867a49d5ab438ea5b04
SSDEEP

12288:VITCy5AwoOAa0CEf6uwWlDqz9avoJ0tDWy4cIZX5pGA/gWPHvvW7:ee62pfzwwnvq0ti6IZX5pVg2vO7

Score

1^/10

Malware Config

Signatures

Files

NEAS.ad37b56d53795944240011ff4eebbd30_JC.exe
.dll windows:10 windows x64

4b81d015455c3d017eaecda4fcdf4c62

Code Sign

33:00:00:00:bc:e1:20:fd:d2:7c:c8:ee:93:00:00:00:00:00:bc
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/08/2015, 17:15

Not After

18/11/2016, 17:15

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1c:6e:cb:9e:e3:0a:53:7c:4f:3f:b0:b0:32:e5:e6:37:bf:ce:6e:39:3b:92:8b:e2:d2:33:d5:46:0d:ba:1e:95
Signer

Actual PE Digest

1c:6e:cb:9e:e3:0a:53:7c:4f:3f:b0:b0:32:e5:e6:37:bf:ce:6e:39:3b:92:8b:e2:d2:33:d5:46:0d:ba:1e:95

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_amsg_exit
_lock
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
_initterm
??0exception@@QEAA@XZ
__C_specific_handler
__dllonexit
memcpy
__CxxFrameHandler3
_CxxThrowException
wcsncpy_s
_wtof
wcsnlen
memcpy_s
_onexit
_wtoi
_itoa_s
??0exception@@QEAA@AEBQEBD@Z
_ltoa_s
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_XcptFilter
_free_locale
_sprintf_s_l
_create_locale
_wcsicmp_l
_vsnwprintf
malloc
sqrt
sinf
sin
powf
memset
memcmp
cosf
free
memmove
qsort
_purecall
_finite
_unlock
sqrtf

api-ms-win-core-synch-l1-2-0

AcquireSRWLockShared
InitializeSRWLock
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
CreateEventW
Sleep
InitializeCriticalSection
DeleteCriticalSection
InitOnceExecuteOnce
LeaveCriticalSection
ReleaseSRWLockShared
EnterCriticalSection
AcquireSRWLockExclusive

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventSetInformation
EventWrite
EventWriteTransfer

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount64
GetTickCount
GetNativeSystemInfo

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
FreeLibrary
LoadResource
SizeofResource
LockResource
GetProcAddress
GetModuleHandleW
LoadLibraryExW
GetModuleHandleExW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-errorhandling-l1-1-1

GetLastError
RaiseException
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-memory-l1-1-2

VirtualFree
VirtualAlloc
MapViewOfFile
CreateFileMappingW

api-ms-win-core-processthreads-l1-1-2

GetCurrentThread
GetCurrentProcess
OpenThreadToken
SetThreadToken
TerminateThread
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
OpenProcessToken

api-ms-win-core-errorhandling-l1-1-3

TerminateProcessOnMemoryExhaustion
RaiseFailFastException

api-ms-win-core-winrt-error-l1-1-1

GetRestrictedErrorInfo
RoOriginateError
SetRestrictedErrorInfo
RoReportFailedDelegate
RoOriginateErrorW
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
RoTransformError

api-ms-win-core-debug-l1-1-1

OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-winrt-string-l1-1-0

WindowsSubstringWithSpecifiedLength
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsDuplicateString
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsDeleteString
WindowsCreateString

api-ms-win-core-com-l1-1-1

RoGetAgileReference
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoTaskMemFree

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-security-base-l1-2-0

GetTokenInformation

api-ms-win-core-processenvironment-l1-2-0

GetEnvironmentVariableW

api-ms-win-core-heap-l1-2-0

HeapReAlloc
HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-rtlsupport-l1-2-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureStackBackTrace

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegQueryValueExW

api-ms-win-core-kernel32-legacy-l1-1-1

FindResourceA

ntdll

DbgPrintEx
NtQuerySystemInformation
DbgPrompt
RtlNumberGenericTableElements
RtlInsertElementGenericTable
RtlLookupElementGenericTable
RtlDeleteElementGenericTable
RtlEnumerateGenericTableWithoutSplaying
RtlInitializeGenericTable
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfStateChangeNotification
RtlFreeHeap
RtlAllocateHeap
RtlCreateHeap
NtUnmapViewOfSection
RtlDestroyHeap
RtlGetLastNtStatus
RtlGetElementGenericTable

api-ms-win-rtcore-ntuser-private-l1-1-0

CreateDCompositionHwndTarget
DestroyDCompositionHwndTarget

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

Exports

Exports

CompileEffectDescription
CreateEffectDescription
DCompositionAttachMouseWheelToHwnd
DCompositionCreateDevice
DCompositionCreateDevice2
DCompositionCreateDevice3
DCompositionCreateSurfaceHandle
DeserializeEffectDescription
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
SerializeEffectDescription

Sections

.text
Size: 604KB - Virtual size: 604KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 165KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4b81d015455c3d017eaecda4fcdf4c62

Code Sign

33:00:00:00:bc:e1:20:fd:d2:7c:c8:ee:93:00:00:00:00:00:bcCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

1c:6e:cb:9e:e3:0a:53:7c:4f:3f:b0:b0:32:e5:e6:37:bf:ce:6e:39:3b:92:8b:e2:d2:33:d5:46:0d:ba:1e:95Signer

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-synch-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-memory-l1-1-2

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-errorhandling-l1-1-3

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-localization-l1-2-1

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

ntdll

api-ms-win-rtcore-ntuser-private-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 604KB - Virtual size: 604KB

.rdata Size: 165KB - Virtual size: 164KB

.data Size: 3KB - Virtual size: 17KB

.pdata Size: 53KB - Virtual size: 53KB

.didat Size: 512B - Virtual size: 128B

.rsrc Size: 38KB - Virtual size: 38KB

.reloc Size: 7KB - Virtual size: 7KB

33:00:00:00:bc:e1:20:fd:d2:7c:c8:ee:93:00:00:00:00:00:bc
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

1c:6e:cb:9e:e3:0a:53:7c:4f:3f:b0:b0:32:e5:e6:37:bf:ce:6e:39:3b:92:8b:e2:d2:33:d5:46:0d:ba:1e:95
Signer

.text
Size: 604KB - Virtual size: 604KB

.rdata
Size: 165KB - Virtual size: 164KB

.data
Size: 3KB - Virtual size: 17KB

.pdata
Size: 53KB - Virtual size: 53KB

.didat
Size: 512B - Virtual size: 128B

.rsrc
Size: 38KB - Virtual size: 38KB

.reloc
Size: 7KB - Virtual size: 7KB