NEAS[.]b103189ffa04bf74df298b86c1894410_JC[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.b103189ffa04bf74df298b86c1894410_JC.exe
Size

344KB
MD5

b103189ffa04bf74df298b86c1894410
SHA1

35fec71e4929ce7c08f385d15db2ff5246e82f67
SHA256

2462f857ece28ee1b7a84b6557f6affc6a9999f657ae03e1ab24a8af1ce8d529
SHA512

0c600619f328ee0425d81dc7d1d1695e0ab8a029354ae4bd61132f1d0a277da3157a58eb5fb796175cfccf9dc897c7b83c63f61ac565186c299b16da144a42f3
SSDEEP

6144:i8kT8S+VwXIgias355HxvC334367eYat4BN0lOjxUDGZ9GKBV+UdvrEFp7hKA:iX8HwXIgc5NxviaoHZsKBjvrEH7j

Score

1^/10

Malware Config

Signatures

Files

NEAS.b103189ffa04bf74df298b86c1894410_JC.exe
.dll windows:4 windows x86

8230b7a66343dc0ecf57aa6563d0dbe0

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e0:4f:3f:5b:78:ca:4d:71:0f:15:8a:bf:fe:05:0f:97
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

03/11/2022, 00:00

Not After

02/11/2025, 23:59

Subject

CN=AOMEI International Network Limited,O=AOMEI International Network Limited,ST=Hong Kong,C=HK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e0:4f:3f:5b:78:ca:4d:71:0f:15:8a:bf:fe:05:0f:97
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

03/11/2022, 00:00

Not After

02/11/2025, 23:59

Subject

CN=AOMEI International Network Limited,O=AOMEI International Network Limited,ST=Hong Kong,C=HK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

81:88:79:8a:30:a2:a0:20:5d:f6:cb:c7:7c:58:92:5b:36:08:6d:ed:a2:f4:a0:b2:c9:40:e4:9d:31:61:dd:43
Signer

Actual PE Digest

81:88:79:8a:30:a2:a0:20:5d:f6:cb:c7:7c:58:92:5b:36:08:6d:ed:a2:f4:a0:b2:c9:40:e4:9d:31:61:dd:43

Digest Algorithm

sha256

PE Digest Matches

false

f5:08:11:58:1f:85:34:38:1c:05:d5:f7:52:3f:fe:80:d6:82:e8:9f
Signer

Actual PE Digest

f5:08:11:58:1f:85:34:38:1c:05:d5:f7:52:3f:fe:80:d6:82:e8:9f

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

comn

GetObjectVol
GetObjectLang
GetObjectSys
CreateObjectPat
GetObjectLog
GetObjectGpt
GetObjectSyl

ldm

GetObjectDyd
CreateObjectDyd
CreateObjectDyv
CreateObjectLio

device

CreateDeviceIO

brfat

ord1
ord2

brntfs

ord1
ord2

ntdll

_aulldiv
_allmul
memcpy
_alldiv
mbstowcs
strrchr
sprintf
RtlInitUnicodeString
ZwUnloadKey
ZwClose
ZwCreateFile
RtlNtStatusToDosError
ZwOpenFile
ZwSetInformationFile
_wtoi
_wcslwr
_strlwr
_strnicmp
strncpy
wcsstr
isalpha
_wcsnicmp
atoi
wcsncpy
_wcsicmp
wcstombs
iswalpha
memset
_chkstk
_allrem
strstr

exfatstd

CreateObjExfatStd

kernel32

GetCurrentThreadId
QueryPerformanceCounter
GetCurrentProcessId
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
SetFilePointer
DeviceIoControl
ReadFile
CreateFileW
CloseHandle
GetVersionExW
WriteFile
GetLogicalDrives
LoadLibraryW
GetWindowsDirectoryW
FlushFileBuffers
FreeLibrary
GetCurrentProcess
GetProcAddress
SetLastError
GetFileSizeEx
GetTickCount
Sleep
GetLogicalDriveStringsA
GetFileAttributesA
CreateFileA
GetLocalTime
DefineDosDeviceW
GetVolumeInformationW
GetLastError
SetFilePointerEx
WinExec
GetSystemInfo
GetModuleHandleW
InterlockedCompareExchange
InterlockedExchange

advapi32

RegEnumValueW
CloseServiceHandle
AdjustTokenPrivileges
OpenProcessToken
RegUnLoadKeyW
OpenSCManagerW
OpenServiceW
StartServiceW
RegDeleteValueA
RegOpenKeyA
RegQueryValueExA
RegSetValueExA
RegFlushKey
RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegLoadKeyW
CreateServiceW
RegQueryValueExW
LookupPrivilegeValueW

ole32

CoInitialize
CoInitializeSecurity
CoUninitialize
CoCreateInstance

oleaut32

SysAllocString

msvcp80

??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z

msvcr80

_encoded_null
free
_malloc_crt
_encode_pointer
?terminate@@YAXXZ
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
_CxxThrowException
__CppXcptFilter
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
__CxxFrameHandler3
_decode_pointer
strncat_s
??3@YAXPAX@Z
??_V@YAXPAX@Z
strcpy_s
strncpy_s
??2@YAPAXI@Z
_swprintf
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
_invalid_parameter_noinfo
memmove_s
_vswprintf
wcscpy_s
_wassert
fclose
fgets
fopen
memcpy_s
swscanf
wcsncpy_s
vswprintf_s

Exports

Exports

CreateBootMgrHelp
CreateDdmManager
CreateProgObject
CreateTaskObject

Sections

.text
Size: 196KB - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 428B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8230b7a66343dc0ecf57aa6563d0dbe0

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

e0:4f:3f:5b:78:ca:4d:71:0f:15:8a:bf:fe:05:0f:97Certificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

e0:4f:3f:5b:78:ca:4d:71:0f:15:8a:bf:fe:05:0f:97Certificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

81:88:79:8a:30:a2:a0:20:5d:f6:cb:c7:7c:58:92:5b:36:08:6d:ed:a2:f4:a0:b2:c9:40:e4:9d:31:61:dd:43Signer

f5:08:11:58:1f:85:34:38:1c:05:d5:f7:52:3f:fe:80:d6:82:e8:9fSigner

Headers

File Characteristics

Imports

comn

ldm

device

brfat

brntfs

ntdll

exfatstd

kernel32

advapi32

ole32

oleaut32

msvcp80

msvcr80

Exports

Exports

Sections

.text Size: 196KB - Virtual size: 192KB

.rdata Size: 28KB - Virtual size: 27KB

.data Size: 4KB - Virtual size: 4KB

.rsrc Size: 4KB - Virtual size: 428B

.reloc Size: 12KB - Virtual size: 10KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

e0:4f:3f:5b:78:ca:4d:71:0f:15:8a:bf:fe:05:0f:97
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

e0:4f:3f:5b:78:ca:4d:71:0f:15:8a:bf:fe:05:0f:97
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

81:88:79:8a:30:a2:a0:20:5d:f6:cb:c7:7c:58:92:5b:36:08:6d:ed:a2:f4:a0:b2:c9:40:e4:9d:31:61:dd:43
Signer

f5:08:11:58:1f:85:34:38:1c:05:d5:f7:52:3f:fe:80:d6:82:e8:9f
Signer

.text
Size: 196KB - Virtual size: 192KB

.rdata
Size: 28KB - Virtual size: 27KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 428B

.reloc
Size: 12KB - Virtual size: 10KB