NEAS[.]49fc6ee26f937b150c701d7b7abfb060_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.49fc6ee26f937b150c701d7b7abfb060_JC.exe
Size

620KB
MD5

49fc6ee26f937b150c701d7b7abfb060
SHA1

03f31bff8ec78cc13998196bf4aac93e18139de6
SHA256

6f5044056b7d90a583413dc2efce2a07c788efd567991b95065fed05bbba179e
SHA512

e25af212f0932b1db93cebe6fe04d7cef2eff652e11106ddc4389118c4d6029ec471ae383d6e9dbb837bab5c291b1650c7d03831523f49c2fd44f86e01a800dd
SSDEEP

12288:Wh4PsivO1quj6y5nvUIjKHqlUlGEoksDaUaMqm0ewt:WhWvONh5nsIWqlUGEoVWUaMqm0ewt

Score

1^/10

Malware Config

Signatures

Files

NEAS.49fc6ee26f937b150c701d7b7abfb060_JC.exe
.exe windows:4 windows x86

34d9d97c70adc6cb51935b8cdf681519

Code Sign

72:cf:a0:e0:5b:91:9f:83:4b:61:92:25:f0:a5:ba:9f
Certificate

Issuer

CN=Entrust Code Signing CA - OVCS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

04/12/2020, 15:46

Not After

04/12/2021, 15:46

Subject

CN=Entrust Corporation,O=Entrust Corporation,L=Shakopee,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

43:c1:0b:1c:00:00:00:00:51:d3:73:da
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

10/06/2015, 13:46

Not After

10/11/2030, 14:16

Subject

CN=Entrust Code Signing CA - OVCS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:63:de:f8
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

24/12/1999, 17:50

Not After

24/07/2029, 14:15

Subject

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

22/07/2015, 19:02

Not After

22/06/2029, 19:32

Subject

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4
Certificate

Issuer

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

22/07/2020, 15:33

Not After

29/12/2030, 16:29

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

8f:a2:08:62:a6:4c:70:30:37:a3:36:4b:59:fc:51:eb:b3:00:da:90
Signer

Actual PE Digest

8f:a2:08:62:a6:4c:70:30:37:a3:36:4b:59:fc:51:eb:b3:00:da:90

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

netapi32

NetUserGetLocalGroups
NetUserGetGroups
NetLocalGroupEnum
NetQueryDisplayInformation
NetGetDCName
NetLocalGroupAdd
NetLocalGroupDel
NetUserGetInfo
NetUserAdd
NetUserChangePassword
NetUserDel
NetLocalGroupAddMembers
NetWkstaGetInfo
NetApiBufferFree

shlwapi

SHDeleteKeyA

objsrvcommapi

?GetDwordPropertyValue@CDrmApi@@QAE?AW4DrmApiStatus@@ABVCClientInfo@@ABVCScpmDwordProperty@DatacardSCPM@@AAK@Z
?GetStringPropertyValue@CDrmApi@@QAE?AW4DrmApiStatus@@ABVCClientInfo@@ABVCScpmStringProperty@DatacardSCPM@@AAVCString@@@Z
?GetBinaryPropertyValue@CDrmApi@@QAE?AW4DrmApiStatus@@ABVCClientInfo@@ABVCScpmBinaryProperty@DatacardSCPM@@AAVCByteArray@@@Z
?GetBoolPropertyValue@CDrmApi@@QAE?AW4DrmApiStatus@@ABVCClientInfo@@ABVCScpmBoolProperty@DatacardSCPM@@AA_N@Z
?DrmTerminate@CDrmApi@@SA?AW4DrmApiStatus@@VCString@@@Z
?DrmInitialize@CDrmApi@@SA?AW4DrmApiStatus@@VCString@@@Z
?UserSecurityGetUserAccessRights@CDrmApi@@QAE?AW4DrmApiStatus@@ABVCClientInfo@@AAJ@Z
?UserSecuritySetRights@CDrmApi@@QAE?AW4DrmApiStatus@@ABVCClientInfo@@AAVCUserSecurity@@@Z
?UserSecurityDeleteGroup@CDrmApi@@QAE?AW4DrmApiStatus@@ABVCClientInfo@@_J@Z
?UserSecurityInsertGroup@CDrmApi@@QAE?AW4DrmApiStatus@@ABVCClientInfo@@AAVCUserSecurity@@@Z
?UserSecurityGetWindowsGroups@CDrmApi@@QAE?AW4DrmApiStatus@@ABVCClientInfo@@AAVCStringArray@@@Z
?UserSecurityGetGroups@CDrmApi@@QAE?AW4DrmApiStatus@@ABVCClientInfo@@ABVCUserSecurity@@AAV?$CComPackageArray@VCUserSecurity@@$04$0A@@@@Z
?EventLogGetUserNames@CDrmApi@@QAE?AW4DrmApiStatus@@ABVCClientInfo@@AAVCStringArray@@@Z
?EventLogGetMachineNames@CDrmApi@@QAE?AW4DrmApiStatus@@ABVCClientInfo@@AAVCStringArray@@@Z
?EventLogDeleteOldEvents@CDrmApi@@QAE?AW4DrmApiStatus@@ABVCClientInfo@@@Z
?EventLogDeleteRange@CDrmApi@@QAE?AW4DrmApiStatus@@ABVCClientInfo@@ABV?$CComPackageArray@VCEventInfo@@$02$0A@@@VCString@@2ABV?$CComPackageArray@V?$CPackageType@_J$07@@$08$0A@@@@Z
?EventLogGetRecordCount@CDrmApi@@QAE?AW4DrmApiStatus@@ABVCClientInfo@@ABV?$CComPackageArray@VCEventInfo@@$02$0A@@@VCString@@2AAJ@Z
?EventLogFetchEvents@CDrmApi@@QAE?AW4DrmApiStatus@@ABVCClientInfo@@ABV?$CComPackageArray@VCEventInfo@@$02$0A@@@VCString@@2_J_NAAJAAV4@@Z
??0CDrmApi@@QAE@XZ
??1CDrmApi@@QAE@XZ
?SetDwordPropertyValue@CDrmApi@@QAE?AW4DrmApiStatus@@ABVCClientInfo@@ABVCScpmDwordProperty@DatacardSCPM@@K@Z
?SetStringPropertyValue@CDrmApi@@QAE?AW4DrmApiStatus@@ABVCClientInfo@@ABVCScpmStringProperty@DatacardSCPM@@ABVCString@@@Z
?EventLogWriteEvent@CDrmApi@@SA?AW4DrmApiStatus@@ABVCClientInfo@@ABVCEventInfo@@@Z
?SetBoolPropertyValue@CDrmApi@@QAE?AW4DrmApiStatus@@ABVCClientInfo@@ABVCScpmBoolProperty@DatacardSCPM@@_N@Z
?SetBinaryPropertyValue@CDrmApi@@QAE?AW4DrmApiStatus@@ABVCClientInfo@@ABVCScpmBinaryProperty@DatacardSCPM@@ABVCByteArray@@@Z

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

mfc42

ord3136
ord3262
ord2985
ord3081
ord2976
ord3402
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4424
ord641
ord800
ord610
ord540
ord287
ord567
ord324
ord2135
ord825
ord818
ord2302
ord4234
ord2241
ord1238
ord2645
ord3005
ord4710
ord2688
ord823
ord1849
ord2583
ord4589
ord4588
ord4899
ord4370
ord4892
ord4532
ord5076
ord4341
ord4349
ord4723
ord4890
ord4531
ord4545
ord4543
ord4526
ord4529
ord4524
ord4964
ord4961
ord4108
ord4403
ord5240
ord3748
ord1726
ord5253
ord3371
ord4432
ord3641
ord801
ord711
ord663
ord1105
ord1146
ord1168
ord2096
ord384
ord541
ord413
ord348
ord303
ord813
ord710
ord4165
ord412
ord2408
ord2453
ord4244
ord2652
ord6307
ord521
ord1200
ord5861
ord3811
ord3996
ord2862
ord1669
ord4167
ord537
ord6301
ord858
ord6883
ord535
ord6907
ord3998
ord2818
ord860
ord551
ord4278
ord4129
ord3337
ord5710
ord2763
ord6877
ord3301
ord4133
ord4297
ord3078
ord2535
ord4614
ord4613
ord6508
ord609
ord692
ord6143
ord922
ord3499
ord2515
ord355
ord6199
ord2863
ord795
ord6215
ord5148
ord3756
ord3754
ord2379
ord6905
ord1199
ord3584
ord543
ord803
ord2915
ord941
ord939
ord924
ord4465
ord6366
ord2413
ord2024
ord4219
ord2581
ord4401
ord3639
ord2575
ord4396
ord3574
ord6741
ord2301
ord2362
ord2358
ord6640
ord6334
ord2642
ord3092
ord3803
ord6767
ord5981
ord1834
ord5067
ord4635
ord4607
ord4716
ord4750
ord4608
ord5016
ord4375
ord4852
ord4834
ord4229
ord3525
ord6093
ord2370
ord4160
ord1949
ord3528
ord6094
ord4034
ord3721
ord326
ord2086
ord1842
ord4242
ord2723
ord2390
ord3059
ord5100
ord5103
ord4467
ord4303
ord3350
ord5012
ord975
ord5472
ord3403
ord2879
ord2878
ord4151
ord4077
ord5237
ord5282
ord2649
ord1665
ord4436
ord4427
ord796
ord674
ord554
ord529
ord366
ord807
ord2494
ord2627
ord2626
ord6000
ord2117
ord4163
ord6625
ord4457
ord5252
ord5572
ord926
ord4615
ord4612
ord4610
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1576
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord815
ord561
ord617
ord5301
ord5214
ord296
ord986
ord520
ord2621
ord2764
ord4202
ord2864
ord1134
ord2725
ord1825
ord4238
ord4696
ord3058
ord3065
ord6336
ord2510
ord2542
ord5243
ord5740
ord1746
ord5577
ord3172
ord5653
ord4420
ord4953
ord4858
ord2399
ord4387
ord3454
ord3198
ord6080
ord6175
ord4623
ord4426
ord338
ord652
ord4823
ord6329
ord6876
ord5683
ord2827
ord4277
ord6662
ord940
ord2614
ord536
ord6139
ord1622
ord5857
ord2842
ord1615
ord4204
ord6874
ord3873
ord3876
ord3317
ord6663
ord6283
ord2393
ord798
ord5465
ord532
ord665
ord5442
ord353
ord5448
ord6407
ord6385
ord913
ord5594
ord1601
ord3259
ord3147
ord2982
ord5277
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1776
ord4078
ord6055
ord3597
ord4425
ord2124
ord5280
ord1775
ord6052
ord2514
ord4998
ord4853
ord4376
ord5265
ord1771
ord1089

msvcrt

_except_handler3
_controlfp
_onexit
__dllonexit
??1type_info@@UAE@XZ
_ultoa
_mkdir
_errno
_rmdir
atol
rand
mbstowcs
wcscpy
wcscat
wcslen
sscanf
isdigit
strncpy
mktime
localtime
__set_app_type
time
isprint
strchr
_itoa
isspace
toupper
strtok
malloc
free
_CxxThrowException
??0exception@@QAE@ABV0@@Z
_atoi64
sprintf
_mbscmp
atoi
_mbsicmp
_ftol
__CxxFrameHandler
_purecall
__p__fmode
_setmbcp
_strnicmp
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
ctime
_exit

kernel32

SetThreadPriority
lstrlenW
DeleteFileA
FindFirstFileA
FindNextFileA
FindClose
OpenFile
GetFileAttributesExA
FileTimeToSystemTime
GetTempPathA
WritePrivateProfileStringA
GetPrivateProfileStringA
InterlockedDecrement
lstrlenA
GetTickCount
Sleep
ResetEvent
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
lstrcmpiA
WinExec
GetSystemDirectoryA
GetVersionExA
GetModuleHandleA
GetLastError
CreateMutexA
FreeLibrary
GetProcAddress
LoadLibraryA
lstrcpyA
MultiByteToWideChar
WideCharToMultiByte
GetTimeFormatA
GetDateFormatA
LocalAlloc
GlobalUnlock
GlobalLock
GlobalAlloc
GetCurrentThreadId
SetConsoleTitleA
GetCurrentProcessId
GetConsoleTitleA
GetEnvironmentVariableA
WaitForSingleObject
CreateProcessA
GetStartupInfoA
LocalFree
FormatMessageA
SetEvent

user32

DrawMenuBar
GetSubMenu
EnableMenuItem
GetMenu
InvalidateRect
GetKeyState
SendMessageA
LoadIconA
wsprintfA
UpdateWindow
GetLastActivePopup
GetMenuStringA
GetMenuItemCount
keybd_event
SetForegroundWindow
FindWindowA
GetWindowTextLengthA
GetWindowTextA
GetClassNameA
EnumThreadWindows
GetClipboardData
OpenClipboard
EmptyClipboard
CloseClipboard
EnableWindow
SetClipboardData
MessageBoxA
LoadStringA
GetDesktopWindow
GetWindow
GetPropA
SetPropA
IsIconic

gdi32

GetDeviceCaps
EndPage
AbortDoc
StartPage

advapi32

LsaAddAccountRights
RegQueryValueExA
RegOpenKeyExA
GetUserNameA
GetNamedSecurityInfoA
SetEntriesInAclA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegEnumKeyExA
RegQueryInfoKeyA
RegEnumValueA
LsaQueryInformationPolicy
LsaFreeMemory
LookupAccountNameA
FreeSid
LsaOpenPolicy
LsaNtStatusToWinError
LsaStorePrivateData
LsaClose
AllocateAndInitializeSid
CheckTokenMembership
RegCloseKey

shell32

SHGetMalloc
SHGetFolderPathA
SHGetPathFromIDListA
SHBrowseForFolderA

comctl32

ImageList_ReplaceIcon

ole32

CoInitialize
OleUninitialize
OleInitialize
CoInitializeEx
CoUninitialize

oleaut32

CreateErrorInfo
SetErrorInfo
GetErrorInfo
VariantChangeType
VariantClear
SysFreeString
SafeArrayUnaccessData
SysAllocString
SafeArrayCreate
SafeArrayCreateVector
VariantInit
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData

msvcp60

??0logic_error@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??_7out_of_range@std@@6B@
??0logic_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Xlen@std@@YAXXZ
?_Xran@std@@YAXXZ
??0out_of_range@std@@QAE@ABV01@@Z
??1out_of_range@std@@UAE@XZ

wsock32

ntohs
gethostbyname
gethostname
WSACleanup
WSAStartup
gethostbyaddr
ioctlsocket
recv
connect
htons
closesocket
send
htonl
socket
select
shutdown
WSAGetLastError
inet_ntoa
bind

Sections

.text
Size: 344KB - Virtual size: 343KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 128KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

34d9d97c70adc6cb51935b8cdf681519

Code Sign

72:cf:a0:e0:5b:91:9f:83:4b:61:92:25:f0:a5:ba:9fCertificate

Extended Key Usages

Key Usages

43:c1:0b:1c:00:00:00:00:51:d3:73:daCertificate

Extended Key Usages

Key Usages

38:63:de:f8Certificate

Key Usages

58:da:13:ff:00:00:00:00:51:ce:0d:f7Certificate

Extended Key Usages

Key Usages

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4Certificate

Extended Key Usages

Key Usages

8f:a2:08:62:a6:4c:70:30:37:a3:36:4b:59:fc:51:eb:b3:00:da:90Signer

Headers

File Characteristics

Imports

netapi32

shlwapi

objsrvcommapi

version

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

oleaut32

msvcp60

wsock32

Sections

.text Size: 344KB - Virtual size: 343KB

.rdata Size: 56KB - Virtual size: 55KB

.data Size: 28KB - Virtual size: 31KB

.idata Size: 16KB - Virtual size: 14KB

.rsrc Size: 128KB - Virtual size: 124KB

.reloc Size: 36KB - Virtual size: 32KB

72:cf:a0:e0:5b:91:9f:83:4b:61:92:25:f0:a5:ba:9f
Certificate

43:c1:0b:1c:00:00:00:00:51:d3:73:da
Certificate

38:63:de:f8
Certificate

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4
Certificate

8f:a2:08:62:a6:4c:70:30:37:a3:36:4b:59:fc:51:eb:b3:00:da:90
Signer

.text
Size: 344KB - Virtual size: 343KB

.rdata
Size: 56KB - Virtual size: 55KB

.data
Size: 28KB - Virtual size: 31KB

.idata
Size: 16KB - Virtual size: 14KB

.rsrc
Size: 128KB - Virtual size: 124KB

.reloc
Size: 36KB - Virtual size: 32KB