NEAS[.]996c6c1207ad57803206b4ac52dbb980_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.996c6c1207ad57803206b4ac52dbb980_JC.exe
Size

126KB
MD5

996c6c1207ad57803206b4ac52dbb980
SHA1

05484cc7b771a3b4761be069ad70819dda1adc73
SHA256

289d7c68edea65efcaea5c6649b1e5a6ef1ca685caa91e578778f8a5ec3b1e1d
SHA512

a7115d79dc63cc8da8e1d39b0d05baf3649bb935bc9249546fd2007d87bbdc759dc56c998b69a821acbba526304ad4e89d4b2cdab0154a4c8a2d01534bb73b26
SSDEEP

3072:yIcUQCQsPuUZ3cuAM1zvpesf5SAd/RBcADzhz/z8xc7jIyy:yGQC3PDTAepDbRHf8mnI5

Score

1^/10

Malware Config

Signatures

Files

NEAS.996c6c1207ad57803206b4ac52dbb980_JC.exe
.exe windows:6 windows x86

f7f23cc5d372b504b205ffd3de39b1dd

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:3a:58:33:80:c4:d7:6a:bf:d3:33:5a:9f:ae:34:2c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

06/07/2023, 00:00

Not After

10/06/2024, 23:59

Subject

SERIALNUMBER=6397588,CN=Nmap Software LLC,O=Nmap Software LLC,L=Beaverton,ST=Oregon,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:82:bb:bd:97:b2:e2:8a:30:fb:b0:76:71:d0:a4:96:d2:d2:d4:6b:77:b8:b2:b6:5b:06:2c:c3:6e:32:b6:e8
Signer

Actual PE Digest

13:82:bb:bd:97:b2:e2:8a:30:fb:b0:76:71:d0:a4:96:d2:d2:d4:6b:77:b8:b2:b6:5b:06:2c:c3:6e:32:b6:e8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
CreateFileA
CloseHandle
CreateThread
OpenProcess
GetProcessHeap
ConnectNamedPipe
FlushFileBuffers
CreateFileW
DisconnectNamedPipe
DuplicateHandle
TerminateProcess
WriteFile
GetCurrentProcess
HeapFree
CreateNamedPipeA
HeapAlloc
ReadFile
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
CompareStringW
LCMapStringW
SetFilePointerEx
GetConsoleMode
ReadConsoleW
HeapSize
HeapReAlloc
GetConsoleOutputCP
DecodePointer
WriteConsoleW

advapi32

IsValidSid
OpenProcessToken
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
AddAccessAllowedAce
GetTokenInformation
SetSecurityDescriptorDacl

Sections

.text
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f7f23cc5d372b504b205ffd3de39b1dd

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

02:3a:58:33:80:c4:d7:6a:bf:d3:33:5a:9f:ae:34:2cCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

13:82:bb:bd:97:b2:e2:8a:30:fb:b0:76:71:d0:a4:96:d2:d2:d4:6b:77:b8:b2:b6:5b:06:2c:c3:6e:32:b6:e8Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

Sections

.text Size: 78KB - Virtual size: 78KB

.rdata Size: 28KB - Virtual size: 27KB

.data Size: 2KB - Virtual size: 4KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 4KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

02:3a:58:33:80:c4:d7:6a:bf:d3:33:5a:9f:ae:34:2c
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

13:82:bb:bd:97:b2:e2:8a:30:fb:b0:76:71:d0:a4:96:d2:d2:d4:6b:77:b8:b2:b6:5b:06:2c:c3:6e:32:b6:e8
Signer

.text
Size: 78KB - Virtual size: 78KB

.rdata
Size: 28KB - Virtual size: 27KB

.data
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB