NEAS[.]fe3e055fc6ca6c9e32dd80528de83eb0_JC[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.fe3e055fc6ca6c9e32dd80528de83eb0_JC.exe
Size

265KB
MD5

fe3e055fc6ca6c9e32dd80528de83eb0
SHA1

89632b2804bb3ed6e5313cf0eee9930985ea0e96
SHA256

14cfdb0f4405ca844293abcebe96dbaa4da7e35946d9264094bda06f1e3f4db5
SHA512

50dc5ae52dd7ed1ec0fa6480e931d3f96ae1197917b48699a05638269bcd87f0138da211fb2d4229f0f4f3983d5128ed8fe9c93cea84eb82a42669116e4cd784
SSDEEP

3072:LMgIpOAAldqyL9yDidnif3AkTH+/9O987tF/9:LMgIQdxJNi/DTb8b9

Score

1^/10

Malware Config

Signatures

Files

NEAS.fe3e055fc6ca6c9e32dd80528de83eb0_JC.exe
.exe windows:4 windows x86

c20eb52231ee50bf1725853f327d9e09

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:aa:b5:d9:54:10:b6:33:8f:e1:63:46:fe:ac:7a:d5
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

21-04-2010 00:00

Not After

04-05-2012 23:59

Subject

CN=American Power Conversion,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=132 Fairgrounds Rd,O=American Power Conversion,L=West Kingston,ST=Rhode Island,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapReAlloc
VirtualAlloc
HeapSize
IsValidLocale
EnumSystemLocalesA
SetFilePointer
GetConsoleCP
GetConsoleMode
SetConsoleCtrlHandler
InterlockedExchange
InitializeCriticalSection
GetTimeZoneInformation
GetLocaleInfoW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
CompareStringA
GetCurrentThread
GetLastError
GetCurrentProcess
GetWindowsDirectoryA
GetUserDefaultLCID
GetLocaleInfoA
WaitForSingleObject
CloseHandle
LoadLibraryA
GetProcAddress
FreeLibrary
GlobalAlloc
GlobalFree
Sleep
GetSystemInfo
IsValidCodePage
GetVersionExA
GetDateFormatA
GetTimeFormatA
EnterCriticalSection
FatalAppExitA
LeaveCriticalSection
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
CompareStringW
LCMapStringA
GetSystemTimeAsFileTime
RtlUnwind
SetEnvironmentVariableA
GetCurrentDirectoryA
SetCurrentDirectoryA
GetFileAttributesA
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
RaiseException
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId

user32

RedrawWindow
ReleaseDC
LoadCursorA
GetClientRect
DefWindowProcA
PostQuitMessage
GetDC
LoadIconA
MessageBoxA
LoadImageA
LoadBitmapA
DialogBoxParamA
LoadStringA
RegisterClassA
SetTimer
InvalidateRect
UpdateWindow
DestroyWindow
BeginPaint
EndPaint

gdi32

SelectPalette
GetObjectA
CreateCompatibleDC
SelectObject
GetDIBColorTable
RealizePalette
SetStretchBltMode
StretchBlt
DeleteDC
DeleteObject
CreatePalette
GetStockObject

advapi32

ControlService
DeleteService
OpenSCManagerA
CreateServiceA
ChangeServiceConfig2A
StartServiceA
CloseServiceHandle
OpenThreadToken
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
OpenServiceA

shell32

ShellExecuteExA

upscontrol

??1CEventGenerator@@UAE@XZ
??1CEvents@@UAE@XZ
?HasEventTriggered@CEvents@@QAE_NW4EventParam@1@@Z
?GetUPSEvents@CEventGenerator@@QAE?AVErrCode@@PAVCEvents@@@Z
??0CEvents@@QAE@XZ
??0CEventGenerator@@QAE@XZ
?CreateNewUPSControl@CUPSControl@@SA?AVErrCode@@PAPAV1@IJ@Z
?InitUPS@CEventGenerator@@QAE?AVErrCode@@XZ
?GetDataItem@CEventGenerator@@QBE?AVErrCode@@_KPAN@Z

Sections

.textbss
Size: - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 208KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c20eb52231ee50bf1725853f327d9e09

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

0d:aa:b5:d9:54:10:b6:33:8f:e1:63:46:fe:ac:7a:d5Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

upscontrol

Sections

.textbss Size: - Virtual size: 92KB

.text Size: 208KB - Virtual size: 204KB

.rdata Size: 24KB - Virtual size: 22KB

.data Size: 8KB - Virtual size: 15KB

.idata Size: 8KB - Virtual size: 5KB

.rsrc Size: 8KB - Virtual size: 5KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

0d:aa:b5:d9:54:10:b6:33:8f:e1:63:46:fe:ac:7a:d5
Certificate

.textbss
Size: - Virtual size: 92KB

.text
Size: 208KB - Virtual size: 204KB

.rdata
Size: 24KB - Virtual size: 22KB

.data
Size: 8KB - Virtual size: 15KB

.idata
Size: 8KB - Virtual size: 5KB

.rsrc
Size: 8KB - Virtual size: 5KB