NEAS[.]2430651ef2cebc1780337cc13c3868a0_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.2430651ef2cebc1780337cc13c3868a0_JC.exe
Size

165KB
MD5

2430651ef2cebc1780337cc13c3868a0
SHA1

9175575535dcb3cd04eeb4c9699da4b1b272636e
SHA256

1a519a25eeae64ed0facfec45dbfc9c9fcd5ffd8941aa5f3dc274451c9edbcae
SHA512

2c0d8d653c68cf7577791468ba1898294466d2ee0305a26cccec6de4612bddd607ad71ddd871dc45cb98af0cb1f8c59dbf74b6a71a15c8e86f947eaa6e207ec8
SSDEEP

3072:PU4AjP1qpTPbYO1DMc5Wifyh6f5bQod6k+ANjrQell:PU4A7123YF6f5d6ktj7z

Score

1^/10

Malware Config

Signatures

Files

NEAS.2430651ef2cebc1780337cc13c3868a0_JC.exe
.dll regsvr32 windows:10 windows x86

066f6ab6aa80586314ebdeec56caebd1

Code Sign

33:00:00:00:8f:d7:76:15:b9:cd:45:8a:74:00:00:00:00:00:8f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/10/2015, 18:14

Not After

07/01/2017, 18:14

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:ef:d8:87:2e:35:a3:82:8a:2f:00:00:00:00:00:ef
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e3:19:43:02:b1:62:32:bd:c5:ba:52:a5:d8:73:dd:c8:0e:de:b1:67:93:72:36:75:c5:b2:f8:b1:f9:31:4b:08
Signer

Actual PE Digest

e3:19:43:02:b1:62:32:bd:c5:ba:52:a5:d8:73:dd:c8:0e:de:b1:67:93:72:36:75:c5:b2:f8:b1:f9:31:4b:08

Digest Algorithm

sha256

PE Digest Matches

true

6d:21:33:4a:c3:35:14:e2:cb:4c:b3:28:64:0d:0e:55:42:14:95:cf
Signer

Actual PE Digest

6d:21:33:4a:c3:35:14:e2:cb:4c:b3:28:64:0d:0e:55:42:14:95:cf

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

wcsncpy_s
iswupper
wcsrchr
_vsnwprintf
wcscat_s
wcsncmp
_vsnwprintf_s
wcscpy_s
wcschr
_wtol
iswdigit
_vsnprintf
swscanf
free
malloc
_callnewh
_XcptFilter
_amsg_exit
_initterm
??1type_info@@UAE@XZ
_except_handler4_common
swprintf_s
_CxxThrowException
__CxxFrameHandler3
memcpy
memset

kernel32

GetCurrentProcess
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
GetLastError
CreateDirectoryA
InitializeCriticalSection
LeaveCriticalSection
GetModuleFileNameW
EnterCriticalSection
GetModuleFileNameA
DeleteCriticalSection
GetVersionExA
GetTempFileNameW
DosDateTimeToFileTime
CreateFileA
SetFilePointer
FreeLibrary
SetFileTime
WriteFile
GetFileAttributesA
GetFileAttributesW
ReadFile
CreateFileW
GetProcAddress
GetTempFileNameA
LoadLibraryA
CloseHandle
DeleteFileW
DeleteFileA
LocalFileTimeToFileTime
GetUserDefaultLCID
lstrlenA
lstrlenW
CreateDirectoryW
WideCharToMultiByte
MultiByteToWideChar

advapi32

RegCreateKeyExA
RegSetValueExW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegOpenKeyExA
RegSetValueExA
RegEnumKeyExA
RegDeleteKeyW
RegDeleteKeyA
RegQueryValueExW
RegQueryValueExA
RegCreateKeyExW

user32

IsCharAlphaA
CharNextExA
IsCharUpperA

oleaut32

UnRegisterTypeLi
SysFreeString
SysAllocString
VariantInit
RegisterTypeLi
LoadTypeLi

msi

ord26
ord118
ord8
ord92
ord19
ord121
ord115
ord165
ord160
ord20
ord48
ord120
ord17
ord116
ord78
ord119
ord171
ord163
ord125
ord158
ord159
ord166
ord32
ord150

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

066f6ab6aa80586314ebdeec56caebd1

Code Sign

33:00:00:00:8f:d7:76:15:b9:cd:45:8a:74:00:00:00:00:00:8fCertificate

Extended Key Usages

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0aCertificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:00:ef:d8:87:2e:35:a3:82:8a:2f:00:00:00:00:00:efCertificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

e3:19:43:02:b1:62:32:bd:c5:ba:52:a5:d8:73:dd:c8:0e:de:b1:67:93:72:36:75:c5:b2:f8:b1:f9:31:4b:08Signer

6d:21:33:4a:c3:35:14:e2:cb:4c:b3:28:64:0d:0e:55:42:14:95:cfSigner

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

advapi32

user32

oleaut32

msi

Exports

Exports

Sections

.text Size: 123KB - Virtual size: 122KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 3KB - Virtual size: 2KB

.rsrc Size: 17KB - Virtual size: 16KB

.reloc Size: 5KB - Virtual size: 5KB

33:00:00:00:8f:d7:76:15:b9:cd:45:8a:74:00:00:00:00:00:8f
Certificate

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:ef:d8:87:2e:35:a3:82:8a:2f:00:00:00:00:00:ef
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

e3:19:43:02:b1:62:32:bd:c5:ba:52:a5:d8:73:dd:c8:0e:de:b1:67:93:72:36:75:c5:b2:f8:b1:f9:31:4b:08
Signer

6d:21:33:4a:c3:35:14:e2:cb:4c:b3:28:64:0d:0e:55:42:14:95:cf
Signer

.text
Size: 123KB - Virtual size: 122KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 17KB - Virtual size: 16KB

.reloc
Size: 5KB - Virtual size: 5KB