Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.1543ded561f1f30981aa47ff5e62e9d0_JC.dll
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEAS.1543ded561f1f30981aa47ff5e62e9d0_JC.dll
Resource
win10v2004-20231020-en
Target
NEAS.1543ded561f1f30981aa47ff5e62e9d0_JC.exe
Size
843KB
MD5
1543ded561f1f30981aa47ff5e62e9d0
SHA1
23429439f4d4a27f692960cb9f18837ce83e03db
SHA256
21979e6ea248eaa5a0b4de30c2406231f5738acf0acb31ce1085d96994b25734
SHA512
7c13c11d46cf96bbc4f8fe8357ba7bdd236c1daeca8d0b0f9ae986d719d7e025525eb40047fafdc3af39ee9ad70123a14d7143a8c9628d53f589387ccf1e22c4
SSDEEP
12288:BJEEZKtIwjBMz6pPD48H99SNHDKlwM+T8sQ5rObyPnA4CITvBnVUzzIJEApZAt7O:B6seF/L48IjswtObA4CITLUzzIJPASEW
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
?isObject@Value@Json@@QEBA_NXZ
??4Value@Json@@QEAAAEAV01@AEBV01@@Z
?isNull@Value@Json@@QEBA_NXZ
?isArray@Value@Json@@QEBA_NXZ
?size@Value@Json@@QEBAIXZ
??AValue@Json@@QEBAAEBV01@I@Z
??4?$CStringT@_W@Cmm@@QEAAAEAV01@PEB_W@Z
?c_str@?$CStringT@_W@Cmm@@QEBAPEB_WXZ
??0?$CStringT@_W@Cmm@@QEAA@XZ
??1?$CStringT@_W@Cmm@@UEAA@XZ
?IsEmpty@?$CStringT@_W@Cmm@@QEBAHXZ
?empty@?$CStringT@_W@Cmm@@QEBA_NXZ
??1CFileName@Cmm@@UEAA@XZ
?IsExists@CFileName@Cmm@@QEBAHXZ
??4?$CStringT@_W@Cmm@@QEAAAEAV01@$$QEAV01@@Z
??H?$CStringT@_W@Cmm@@QEBA?AV01@PEB_W@Z
??0?$CStringT@_W@Cmm@@QEAA@AEBV01@@Z
??Y?$CStringT@_W@Cmm@@QEAAAEAV01@PEB_W@Z
??0?$CStringT@_W@Cmm@@QEAA@$$QEAV01@@Z
??Y?$CStringT@_W@Cmm@@QEAAAEAV01@AEBV01@@Z
??0?$CStringT@_W@Cmm@@QEAA@PEB_W@Z
?IntToString@Cmm@@YAXHAEAV?$CStringT@_W@1@@Z
?StringPrintf@Cmm@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEB_WZZ
??0Value@Json@@QEAA@AEBV01@@Z
??1Value@Json@@QEAA@XZ
??4Value@Json@@QEAAAEAV01@$$QEAV01@@Z
??AValue@Json@@QEAAAEAV01@PEBD@Z
??0Value@Json@@QEAA@H@Z
??AValue@Json@@QEAAAEAV01@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0Value@Json@@QEAA@W4ValueType@1@@Z
??0?$CStringT@D@Cmm@@QEAA@XZ
??1?$CStringT@D@Cmm@@UEAA@XZ
??0CharReaderBuilder@Json@@QEAA@XZ
??1CharReaderBuilder@Json@@UEAA@XZ
?newCharReader@CharReaderBuilder@Json@@UEBAPEAVCharReader@2@XZ
?c_str@?$CStringT@D@Cmm@@QEBAPEBDXZ
??0Value@Json@@QEAA@PEBD@Z
??0Value@Json@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?clear@Value@Json@@QEAAXXZ
?empty@?$CStringT@D@Cmm@@QEBA_NXZ
?empty@Value@Json@@QEBA_NXZ
??0Value@Json@@QEAA@_N@Z
?append@Value@Json@@QEAAAEAV12@$$QEAV12@@Z
?asCString@Value@Json@@QEBAPEBDXZ
?begin@Value@Json@@QEBA?AVValueConstIterator@2@XZ
?end@Value@Json@@QEBA?AVValueConstIterator@2@XZ
?increment@ValueIteratorBase@Json@@IEAAXXZ
?isEqual@ValueIteratorBase@Json@@IEBA_NAEBV12@@Z
?deref@ValueIteratorBase@Json@@IEBAAEBVValue@2@XZ
?StringPrintf@Cmm@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBDZZ
?writeString@Json@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBVFactory@StreamWriter@1@AEBVValue@1@@Z
?Write@CFile@Cmm@@QEAA_KPEBX_K@Z
?isInt@Value@Json@@QEBA_NXZ
?Close@CFile@Cmm@@QEAAXXZ
?CreateAlways@CFile@Cmm@@QEAAXPEB_WW4EAccess@12@@Z
??0?$CStringT@D@Cmm@@QEAA@PEBD@Z
?size@?$CStringT@D@Cmm@@QEBA_KXZ
??0StreamWriterBuilder@Json@@QEAA@XZ
??1StreamWriterBuilder@Json@@UEAA@XZ
??AStreamWriterBuilder@Json@@QEAAAEAVValue@1@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?getMemberNames@Value@Json@@QEBA?AV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@XZ
?removeMember@Value@Json@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?isMemberWithValidFormat@Value@Json@@QEBA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??AValue@Json@@QEBAAEBV01@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?clear@?$CStringT@_W@Cmm@@QEAAXXZ
?StringToInt@Cmm@@YAHAEBV?$CStringT@_W@1@AEAH@Z
CmmMQ_GetService
??4?$CStringT@_W@Cmm@@QEAAAEAV01@AEBV01@@Z
??4?$CStringT@D@Cmm@@QEAAAEAV01@PEBD@Z
?SetLength@?$CStringT@_W@Cmm@@QEAAX_K@Z
?GetBuffer@?$CStringT@_W@Cmm@@QEAAPEA_W_K@Z
?length@?$CStringT@_W@Cmm@@QEBA_KXZ
?cmm_str_convert@@YA_KHPEA_W_KPEBD1@Z
?IsEmpty@?$CStringT@D@Cmm@@QEBAHXZ
?GetAppContext@Cmm@@YAPEAVISSBAppContext@1@XZ
??8?$CStringT@_W@Cmm@@QEBA_NPEB_W@Z
?begin@?$CStringT@_W@Cmm@@QEBA?AV?$_String_const_iterator@V?$_String_val@U?$_Simple_types@_W@std@@@std@@@std@@XZ
?NotifySettingUpdate@zstref@@YAXW4zPolicyScene@zpref@@IAEBV?$CStringT@D@Cmm@@PEAVISettingTransferObserver@1@@Z
?SetLength@?$CStringT@D@Cmm@@QEAAX_K@Z
?GetBuffer@?$CStringT@D@Cmm@@QEAAPEAD_K@Z
?cmm_str_convert@@YA_KHPEAD_KPEB_W1@Z
??M?$CStringT@_W@Cmm@@QEBA_NAEBV01@@Z
??0?$CStringT@D@Cmm@@QEAA@AEBV01@@Z
??_7CFileName@Cmm@@6B@
?size@?$CStringT@_W@Cmm@@QEBA_KXZ
?crbegin@?$CStringT@_W@Cmm@@QEBA?AV?$reverse_iterator@V?$_String_const_iterator@V?$_String_val@U?$_Simple_types@_W@std@@@std@@@std@@@std@@XZ
?reserve@?$CStringT@_W@Cmm@@QEAAX_K@Z
?data@?$CStringT@D@Cmm@@QEBAPEBDXZ
??4?$CStringT@D@Cmm@@QEAAAEAV01@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??Y?$CStringT@D@Cmm@@QEAAAEAV01@PEBD@Z
?Assign@?$CStringT@D@Cmm@@QEAAXPEBD_K@Z
?GetLength@?$CStringT@D@Cmm@@QEBA_KXZ
??Y?$CStringT@_W@Cmm@@QEAAAEAV01@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?AssignOther@?$CStringT@_W@Cmm@@QEAAAEAV12@PEBD@Z
?isMember@Value@Json@@QEBA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?append@Value@Json@@QEAAAEAV12@AEBV12@@Z
??AValue@Json@@QEAAAEAV01@I@Z
?asDouble@Value@Json@@QEBANXZ
??8Value@Json@@QEBA_NAEBV01@@Z
??0Value@Json@@QEAA@N@Z
??0Value@Json@@QEAA@$$QEAV01@@Z
??_7IBasicWorkingMessage@Cmm@@6B@
??0FastWriter@Json@@QEAA@XZ
??AValue@Json@@QEAAAEAV01@H@Z
??1Writer@Json@@UEAA@XZ
?GetDefaultMessageLoop@ZoomWorkerFactory@Cmm@@SAPEAVIZoomMessageLoop@2@XZ
?asInt@Value@Json@@QEBAHXZ
?asString@Value@Json@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?isString@Value@Json@@QEBA_NXZ
?nullSingleton@Value@Json@@SAAEBV12@XZ
??AValue@Json@@QEBAAEBV01@PEBD@Z
??1CFile@Cmm@@QEAA@XZ
?Sleep@CThread@Cmm@@SAXI@Z
?Join@CThread@Cmm@@QEAAXXZ
?isMemberWithValidFormat@Value@Json@@QEBA_NPEBD@Z
?IsQuitMessage@IBasicWorkingMessage@Cmm@@MEBA_NXZ
??1IBasicWorkingMessage@Cmm@@UEAA@XZ
??0IBasicWorkingMessage@Cmm@@QEAA@XZ
??1CCritical@Cmm@@QEAA@XZ
??1CThread@Cmm@@QEAA@XZ
??0CCritical@Cmm@@QEAA@XZ
?Lock@CCritical@Cmm@@QEAAXXZ
?Unlock@CCritical@Cmm@@QEAAXXZ
??0IThread@Cmm@@QEAA@XZ
??0CThread@Cmm@@QEAA@XZ
?IsValid@CThread@Cmm@@QEBAHXZ
?Create@CThread@Cmm@@QEAAXPEAVIThread@2@@Z
?isMember@Value@Json@@QEBA_NPEBD@Z
??Btext_stream_t@ssb@@QEAAPEACXZ
?length@text_stream_t@ssb@@QEBAIXZ
??6log_stream_t@ssb@@QEAAAEAV01@PEB_W@Z
??0local_date_t@ssb@@QEAA@PEA_K@Z
??6log_stream_t@ssb@@QEAAAEAV01@PEBC@Z
??1log_stream_t@ssb@@UEAA@XZ
??0log_stream_t@ssb@@QEAA@PEACIPEBC1@Z
?instance@mem_log_file@ssb@@SAPEAV12@I@Z
??1plugin_lock@mem_log_file@ssb@@QEAA@XZ
??0plugin_lock@mem_log_file@ssb@@QEAA@XZ
get_logger_dir
??6log_stream_t@ssb@@QEAAAEAV01@H@Z
get_cur_pid
??6log_stream_t@ssb@@QEAAAEAV01@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?now@time_strategy@ssb@@SA_KXZ
inet_ntop
?zm_memset_s@ssb@@YAHPEAX_KH1@Z
??6log_stream_t@ssb@@QEAAAEAV01@PEBD@Z
LoadLibraryExW
LoadLibraryW
GetCurrentProcess
TerminateProcess
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
CloseHandle
LocalFree
GetCurrentProcessId
GetProcessHeap
HeapFree
HeapAlloc
CreateEventW
GetProcAddress
SetEvent
DeleteCriticalSection
GetVersionExW
GetLastError
InitializeCriticalSectionAndSpinCount
CreateDirectoryW
IsDebuggerPresent
OutputDebugStringW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetModuleHandleA
WaitForSingleObject
FreeLibrary
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetSystemDirectoryW
VariantClear
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
GetAdaptersAddresses
GetAdaptersInfo
WSACleanup
gethostname
getaddrinfo
freeaddrinfo
WSAStartup
__CxxFrameHandler4
__current_exception_context
__current_exception
memset
__std_terminate
memcmp
memmove
memcpy
__C_specific_handler
__std_exception_copy
_CxxThrowException
_purecall
__std_exception_destroy
__std_type_info_destroy_list
memchr
_cexit
_invalid_parameter_noinfo
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
terminate
_invalid_parameter_noinfo_noreturn
_initterm
_errno
_crt_atexit
_initterm_e
_callnewh
free
malloc
strcmp
strcpy_s
sqrt
ceilf
_time64
__stdio_common_vsprintf_s
InitModule
TermModule
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ