NEAS[.]36037dfd43528e860ba69d90654f0250_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.36037dfd43528e860ba69d90654f0250_JC.exe
Size

508KB
MD5

36037dfd43528e860ba69d90654f0250
SHA1

840493e4f7b01cac0bda670d28410986654dc8af
SHA256

22dd42ed8c43d163aec5e0dce259deb7daf4e172c4fecb0602f7520f2290cad4
SHA512

dfa3d09f714e3123969ddc27ac54a2d74ab5c98f4af73e73863108eb058594b2f17ad87ecab63bbb6f2d7c4f1c65f8a6bcdc4e93dbfa1529765248c499cf0a24
SSDEEP

12288:0g0clwPnGLIjk8cyuwHIBsGskX4ovSJEJBI:0g0clwW8cyuGtkoNJE/I

Score

1^/10

Malware Config

Signatures

Files

NEAS.36037dfd43528e860ba69d90654f0250_JC.exe
.dll regsvr32 windows:10 windows x64

a9ac26f6ddd6ea05db7059917dd2c469

Code Sign

33:00:00:00:bc:e1:20:fd:d2:7c:c8:ee:93:00:00:00:00:00:bc
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/08/2015, 17:15

Not After

18/11/2016, 17:15

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2c:09:9d:de:6b:8d:13:87:5c:be:9f:74:ba:35:0f:ff:6c:f5:c3:5d:40:ca:03:f2:24:73:3f:6f:d3:16:b2:7f
Signer

Actual PE Digest

2c:09:9d:de:6b:8d:13:87:5c:be:9f:74:ba:35:0f:ff:6c:f5:c3:5d:40:ca:03:f2:24:73:3f:6f:d3:16:b2:7f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

strnlen
wcsnlen
time
srand
rand
frexp
strncpy_s
sprintf_s
memcpy_s
calloc
memmove
_vsnwprintf
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
_purecall
__CxxFrameHandler3
memcmp
memcpy
memset
sqrtf

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-memory-l1-1-2

VirtualAlloc
VirtualFree
VirtualProtect

api-ms-win-core-synch-l1-2-0

EnterCriticalSection
LeaveCriticalSection
Sleep
DeleteCriticalSection
InitializeCriticalSection

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
SetLastError
GetLastError
UnhandledExceptionFilter

api-ms-win-core-errorhandling-l1-1-3

RaiseFailFastException

api-ms-win-core-rtlsupport-l1-2-0

RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlDeleteFunctionTable
RtlVirtualUnwind

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetLocalTime
GetSystemTimeAsFileTime
GetVersionExA
GetVersionExW
GlobalMemoryStatusEx
GetTickCount

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleFileNameA
DisableThreadLibraryCalls
GetModuleHandleExW
GetProcAddress

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegQueryValueExW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

mfperfhelper

ord1

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-processenvironment-l1-2-0

GetEnvironmentStringsW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW

api-ms-win-core-file-l1-2-1

GetDiskFreeSpaceW

api-ms-win-core-io-l1-1-1

DeviceIoControl

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 348KB - Virtual size: 348KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a9ac26f6ddd6ea05db7059917dd2c469

Code Sign

33:00:00:00:bc:e1:20:fd:d2:7c:c8:ee:93:00:00:00:00:00:bcCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

2c:09:9d:de:6b:8d:13:87:5c:be:9f:74:ba:35:0f:ff:6c:f5:c3:5d:40:ca:03:f2:24:73:3f:6f:d3:16:b2:7fSigner

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-memory-l1-1-2

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-errorhandling-l1-1-3

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

mfperfhelper

api-ms-win-core-heap-l1-2-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-io-l1-1-1

api-ms-win-core-heap-l2-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 348KB - Virtual size: 348KB

.rdata Size: 134KB - Virtual size: 134KB

.data Size: 1KB - Virtual size: 3KB

.pdata Size: 7KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 144B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 608B

33:00:00:00:bc:e1:20:fd:d2:7c:c8:ee:93:00:00:00:00:00:bc
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

2c:09:9d:de:6b:8d:13:87:5c:be:9f:74:ba:35:0f:ff:6c:f5:c3:5d:40:ca:03:f2:24:73:3f:6f:d3:16:b2:7f
Signer

.text
Size: 348KB - Virtual size: 348KB

.rdata
Size: 134KB - Virtual size: 134KB

.data
Size: 1KB - Virtual size: 3KB

.pdata
Size: 7KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 144B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 608B