NEAS[.]cfc00ccd10a4f2497cd2fac448dcf760_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.cfc00ccd10a4f2497cd2fac448dcf760_JC.exe
Size

812KB
MD5

cfc00ccd10a4f2497cd2fac448dcf760
SHA1

67139ee316464b6d8dcdce5e091d92ba94263023
SHA256

26913854374059c929a2031e26fa75bb3d65544a2ee39f097cdd28838609d4eb
SHA512

852015fa1dfdf3ce1bb38a2664564903ac9d47ccd1f8d0e7039099585ab6bcb112907fde89feaed3332d7c9c6f28207494c4c78b7b4b9d10c95dd90a2065fc9b
SSDEEP

12288:mTARsXh7aj9ThxMgNg3a6B3Gs1JKbI4TgdkZxVTvbYOF:N47aj9TuoUJQIb4xV3YA

Score

1^/10

Malware Config

Signatures

Files

NEAS.cfc00ccd10a4f2497cd2fac448dcf760_JC.exe
.dll windows:6 windows x86

371e7a88d959cef84581824fb0ff3c6c

Code Sign

33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/07/2012, 00:14

Not After

07/10/2013, 00:14

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5f:0b:a1:38:f3:2b:4a:86:39:6e:bd:56:09:98:ef:ae:ae:94:2a:38:60:47:4a:f1:31:08:36:86:92:3b:6c:5d
Signer

Actual PE Digest

5f:0b:a1:38:f3:2b:4a:86:39:6e:bd:56:09:98:ef:ae:ae:94:2a:38:60:47:4a:f1:31:08:36:86:92:3b:6c:5d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

agcore

CValue_FreeValuePointer
ObtainProcessServices
ExtractFirstHeaderValueFromPackedString
MFUnwrapMediaType
RenderTargetBitmapCreate
RenderTargetBitmapRender
RenderTargetBitmapDestroy
ObtainCoreServices

uiautomationcore

UiaReturnRawElementProvider
UiaHostProviderFromHwnd
UiaGetReservedNotSupportedValue

advapi32

GetTraceEnableLevel
RegDeleteValueW
RegDeleteKeyW
OpenProcessToken
GetTokenInformation
UnregisterTraceGuids
RegisterTraceGuidsW
TraceEvent
RegEnumKeyExW
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
ConvertSidToStringSidW
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
InitializeSecurityDescriptor
RegEnumValueW
RegQueryInfoKeyW
GetTraceEnableFlags
GetTraceLoggerHandle
RegCreateKeyExW

kernel32

CreateDirectoryW
lstrlenW
RaiseException
InitializeCriticalSection
FlushInstructionCache
lstrcmpW
MulDiv
GlobalUnlock
GlobalLock
GlobalAlloc
SetLastError
GlobalFree
CreateFileW
GetTempPathW
GetSystemInfo
SetThreadExecutionState
LoadResource
FindResourceW
SetFilePointerEx
GetFileSizeEx
GetPriorityClass
SetPriorityClass
IsProcessorFeaturePresent
WaitForMultipleObjects
GetVolumeInformationW
GetEnvironmentVariableW
GetLocalTime
LockResource
FindResourceExW
GetUserDefaultUILanguage
GlobalSize
GetComputerNameExW
UnregisterWaitEx
RegisterWaitForSingleObject
GetLocaleInfoW
GetUserDefaultLCID
SizeofResource
OutputDebugStringW
SignalObjectAndWait
FindClose
FindFirstFileW
GetWindowsDirectoryW
GetProcessTimes
ReadFile
WriteFile
SetEndOfFile
GetFileTime
GetFileAttributesExW
GetExitCodeProcess
CreateProcessW
DosDateTimeToFileTime
SetFilePointer
TlsFree
TlsAlloc
lstrcmpiW
MultiByteToWideChar
LoadLibraryExW
GetCPInfo
WideCharToMultiByte
DuplicateHandle
LoadLibraryA
GetCommandLineA
RtlUnwind
VirtualQuery
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
OpenEventW
HeapCreate
HeapDestroy
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleA
GetACP
GetOEMCP
IsValidCodePage
HeapSize
LCMapStringW
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
GetTempFileNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
LoadLibraryW
GetProcessHeap
InitializeCriticalSectionAndSpinCount
CreateEventW
SystemTimeToFileTime
VirtualProtect
VirtualFree
VirtualAlloc
IsDebuggerPresent
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
TlsGetValue
LocalAlloc
TlsSetValue
LocalFree
GetSystemTime
GetProcessAffinityMask
QueryPerformanceFrequency
QueryPerformanceCounter
TerminateProcess
GetCurrentThreadId
SetThreadPriority
GetCurrentThread
GetThreadPriority
Sleep
WaitForSingleObject
InterlockedIncrement
InterlockedExchangeAdd
InterlockedExchange
OpenMutexW
CreateMutexW
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
CreateSemaphoreExW
CreateThread
ReleaseMutex
UnmapViewOfFile
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InterlockedDecrement
InterlockedCompareExchange
GetModuleHandleW
GetModuleFileNameW
HeapFree
HeapReAlloc
GetStringTypeExW
GetProcAddress
ReleaseSemaphore
ResetEvent
SetEvent
GetEnvironmentStringsW
FreeLibrary
GetVersionExW
GetLastError
GetCurrentProcess
HeapAlloc
CloseHandle

gdi32

LPtoDP
SaveDC
SetMapMode
SetWindowOrgEx
SetViewportOrgEx
RestoreDC
CreateDCW
CreateRectRgnIndirect
GdiFlush
GetGlyphOutlineW
AddFontMemResourceEx
CreateFontW
RemoveFontMemResourceEx
EndDoc
StartPage
SetDIBitsToDevice
StretchDIBits
EndPage
StartDocW
GetStockObject
GetObjectW
CreateSolidBrush
GetDeviceCaps
BeginPath
Rectangle
SelectClipPath
CreateDIBSection
CreateCompatibleDC
SelectObject
DeleteObject
CreateCompatibleBitmap
BitBlt
DeleteDC

gdiplus

GdiplusShutdown

user32

MsgWaitForMultipleObjectsEx
EndMenu
ToUnicode
TrackMouseEvent
GetMessageExtraInfo
GetWindowThreadProcessId
SetRect
EqualRect
MsgWaitForMultipleObjects
PostQuitMessage
LoadIconW
IsDialogMessageW
SetWindowRgn
OffsetRect
UnionRect
RegisterWindowMessageW
NotifyWinEvent
EnumDisplayMonitors
UnregisterClassA
GetSubMenu
GetCursorPos
WindowFromPoint
TrackPopupMenu
DestroyMenu
MonitorFromWindow
GetMonitorInfoW
PeekMessageW
CallNextHookEx
EnumDisplayDevicesW
EnableWindow
SetPropW
DrawFocusRect
RemovePropW
GetPropW
HideCaret
GetClipboardData
DialogBoxIndirectParamW
OpenClipboard
EmptyClipboard
RegisterClipboardFormatW
SetClipboardData
CloseClipboard
IsClipboardFormatAvailable
GetDoubleClickTime
GetCaretBlinkTime
SystemParametersInfoW
GetSystemMetrics
GetKeyboardState
EndDialog
IsDlgButtonChecked
SetRectEmpty
GetActiveWindow
CharLowerBuffW
GetForegroundWindow
GetClassInfoW
RegisterClassW
CreateAcceleratorTableW
CreateWindowExW
TranslateMessage
DispatchMessageW
KillTimer
SetTimer
WindowFromDC
SetCursor
LoadMenuIndirectW
SetWindowsHookExW
SetMenuItemInfoW
RegisterClassExW
LoadCursorW
GetClassInfoExW
IsWindow
SendMessageW
GetFocus
GetWindow
DestroyAcceleratorTable
BeginPaint
EndPaint
CallWindowProcW
FillRect
ReleaseCapture
GetClassNameW
GetDlgItem
SetCapture
InvalidateRgn
InvalidateRect
ReleaseDC
ScreenToClient
ClientToScreen
MoveWindow
CharNextW
GetSysColor
DestroyWindow
GetDC
GetDesktopWindow
IntersectRect
UpdateWindow
PtInRect
DefWindowProcW
IsChild
GetKeyState
GetWindowRect
SetParent
GetWindowLongW
SetWindowLongW
SetFocus
ShowWindow
RedrawWindow
SetWindowPos
GetParent
FindWindowW
PostMessageW
GetKeyboardLayout
MessageBoxW
DialogBoxParamW
GetClientRect

imm32

ImmAssociateContext
ImmReleaseContext
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetProperty
ImmEscapeW
ImmSetCandidateWindow
ImmGetCompositionStringW
ImmNotifyIME
ImmSetCompositionWindow
ImmGetContext
ImmSetOpenStatus
ImmAssociateContextEx

shell32

ShellExecuteExW
DragQueryFileW
SHGetFolderPathW
ShellExecuteW

comdlg32

PrintDlgExW
GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError

comctl32

ord17
InitCommonControlsEx

ole32

OleRegEnumVerbs
OleRegGetUserType
OleRegGetMiscStatus
OleInitialize
RegisterDragDrop
RevokeDragDrop
OleUninitialize
CreateOleAdviseHolder
CoGetMalloc
CoUninitialize
CoInitialize
CreateStreamOnHGlobal
CoTaskMemAlloc
CLSIDFromString
CLSIDFromProgID
ReleaseStgMedium
CreateBindCtx
CoTaskMemRealloc
ReadClassStm
OleSaveToStream
WriteClassStm
CoInitializeEx
CoGetClassObject
OleLockRunning
StringFromGUID2
OleDraw
CoTaskMemFree
CoCreateInstance

oleaut32

SysStringByteLen
SysStringLen
SysAllocString
SysFreeString
SafeArrayUnaccessData
SafeArrayGetElemsize
SafeArrayPtrOfIndex
SafeArrayUnlock
SysAllocStringLen
VariantInit
SafeArrayLock
SafeArrayGetElement
SafeArrayCreateVector
LoadRegTypeLi
SafeArrayCreate
LoadTypeLi
DispCallFunc
OleCreateFontIndirect
VariantCopy
VariantChangeType
SysAllocStringByteLen
VariantClear
SafeArrayDestroy
OleCreatePropertyFrame
VarUI4FromStr
SafeArrayPutElement
SafeArrayCopy
VarDecFromCy
VariantCopyInd
GetActiveObject
SafeArrayGetDim
SafeArrayGetVartype
SafeArrayAccessData

shlwapi

PathCreateFromUrlW
StrCmpIW
PathFindExtensionW
PathIsRelativeW
PathCombineW
PathRemoveFileSpecW
UrlUnescapeW
PathAppendW
UrlCreateFromPathW

winmm

timeEndPeriod

wininet

InternetErrorDlg
InternetConnectW
HttpOpenRequestW
InternetQueryOptionW
HttpAddRequestHeadersW
HttpSendRequestExW
HttpEndRequestW
InternetCloseHandle
InternetReadFile
HttpQueryInfoW
InternetOpenUrlW
InternetOpenW
InternetCreateUrlW
InternetCrackUrlW
InternetCombineUrlW
HttpSendRequestW
InternetWriteFile
InternetSetOptionW

urlmon

RegisterBindStatusCallback
CreateURLMonikerEx

msimg32

AlphaBlend

psapi

GetProcessMemoryInfo

dsound

ord1

ws2_32

WSASendTo
WSAStartup
WSAEnumNetworkEvents
WSAEventSelect
htons
WSASend
WSARecvFrom
WSAConnect
ioctlsocket
WSAGetLastError
WSAIoctl
WSAGetOverlappedResult
closesocket
socket
WSACleanup
shutdown
bind
accept
connect
getsockname
inet_addr
inet_ntoa
getaddrinfo
freeaddrinfo
getnameinfo
getpeername
getsockopt
setsockopt
ntohs
ntohl
htonl
WSARecv

wintrust

WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData

crypt32

CertEnumCertificatesInStore
CryptDecodeObject
CertCloseStore
CertOpenStore
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertDuplicateCertificateContext
CertGetNameStringW
CertFreeCertificateContext
CertVerifyTimeValidity
CryptHashPublicKeyInfo
CryptVerifyDetachedMessageSignature

pdh

PdhGetFormattedCounterValue
PdhCloseQuery
PdhCollectQueryData
PdhAddCounterW
PdhLookupPerfNameByIndexW
PdhOpenQueryW
PdhMakeCounterPathW

iphlpapi

GetAdaptersInfo
GetIfEntry

netapi32

NetApiBufferFree
NetUserModalsGet

Exports

Exports

AG_RenderToMemory
ComAutomationCheckCrossApartmentAccess
ComAutomationCleanupInteropValue
ComAutomationCleanupInteropValues
ComAutomationConnectEvent
ComAutomationCopyNativeArrayToManagedArray
ComAutomationCreateNativeArray
ComAutomationCreateNativeString
ComAutomationDisconnectEvent
ComAutomationGetCurrent
ComAutomationGetEnumerator
ComAutomationGetObject
ComAutomationInvoke
ComAutomationIsAllowed
ComAutomationMoveNext
ComAutomationReset
ComAutomationSetStringArrayElement
CreateXcpControl
DllCanUnloadNow
ObtainPlatformServices

Sections

.text
Size: 738KB - Virtual size: 738KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

371e7a88d959cef84581824fb0ff3c6c

Code Sign

33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

5f:0b:a1:38:f3:2b:4a:86:39:6e:bd:56:09:98:ef:ae:ae:94:2a:38:60:47:4a:f1:31:08:36:86:92:3b:6c:5dSigner

Headers

DLL Characteristics

File Characteristics

Imports

agcore

uiautomationcore

advapi32

kernel32

gdi32

gdiplus

user32

imm32

shell32

comdlg32

comctl32

ole32

oleaut32

shlwapi

winmm

wininet

urlmon

msimg32

psapi

dsound

ws2_32

wintrust

crypt32

pdh

iphlpapi

netapi32

Exports

Exports

Sections

.text Size: 738KB - Virtual size: 738KB

.data Size: 22KB - Virtual size: 30KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 38KB - Virtual size: 38KB

33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

5f:0b:a1:38:f3:2b:4a:86:39:6e:bd:56:09:98:ef:ae:ae:94:2a:38:60:47:4a:f1:31:08:36:86:92:3b:6c:5d
Signer

.text
Size: 738KB - Virtual size: 738KB

.data
Size: 22KB - Virtual size: 30KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 38KB - Virtual size: 38KB