NEAS[.]07d8d41d811bdca892a30e2cfadff280[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.07d8d41d811bdca892a30e2cfadff280.exe
Size

1.1MB
MD5

07d8d41d811bdca892a30e2cfadff280
SHA1

e4f9e9702e1587a927d859b0069aa9353de2ead6
SHA256

712e9ba3b3f8568ba4098b9a533a8709fd83251d751281147259a7bbae2ee4fc
SHA512

c06e1e803fa4f5abe6ba93919124597e73ed8a7e8e331c775856a983afc9ace32041ea7a30c7a8ad68c51ed0a5a3ab6735d79d1052ec547c66f3d9e395714669
SSDEEP

12288:fRbaUcc5RpmvknGGXvAIzBW75yEJS9yU8eMic1m+GIckz1jSJvWXC01Gq55Sk:5baTw/Aiwc9yU8E2m+66j9dN55L

Score

1^/10

Malware Config

Signatures

Files

NEAS.07d8d41d811bdca892a30e2cfadff280.exe
.dll regsvr32 windows:6 windows x64

851005084f75ce74de8a81847d16fd03

Code Sign

33:00:00:00:74:f0:1e:99:d0:2a:28:6a:ca:00:00:00:00:00:74
Certificate

Issuer

CN=Microsoft Windows Phone Production PCA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 21:15

Not After

28/01/2017, 21:15

Subject

CN=Windows Phone,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0b:fc:f9:8e:58:4c:15:50:bf:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/07/2012, 22:23

Not After

24/07/2027, 22:33

Subject

CN=Microsoft Windows Phone Production PCA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c8:52:d5:b7:81:a7:bd:a7:30:fa:5c:44:58:69:bc:fb:03:96:8d:b0:ac:5a:7c:7d:0e:b3:33:e2:3e:e7:d2:06
Signer

Actual PE Digest

c8:52:d5:b7:81:a7:bd:a7:30:fa:5c:44:58:69:bc:fb:03:96:8d:b0:ac:5a:7c:7d:0e:b3:33:e2:3e:e7:d2:06

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

vcruntime140

memset
__std_type_info_destroy_list
__C_specific_handler
__telemetry_main_return_trigger
memcmp
__telemetry_main_invoke_trigger
strrchr
memmove
wcschr
__unDName
strchr
strstr
memcpy
wcsrchr
_purecall

api-ms-win-crt-string-l1-1-0

strcat_s
_wcsnicmp
strncpy_s
isspace
_memicmp
wcsncat_s
wcscpy_s
_stricmp
strncmp
_wcsicmp
wcscat_s
strcmp
towlower
_wcsdup
wcsncmp
wcsncpy_s
strcpy_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf
_filelengthi64
_wsopen_s
_chsize_s
_get_osfhandle
_write
_read
__stdio_common_vsnprintf_s
__stdio_common_vsnwprintf_s
_close
_lseeki64
ftell
_open_osfhandle
fclose
_wfsopen
fread
__stdio_common_vsprintf_s
fseek
__stdio_common_vswprintf_s

api-ms-win-crt-utility-l1-1-0

qsort
bsearch

api-ms-win-crt-heap-l1-1-0

calloc
malloc
free

api-ms-win-crt-convert-l1-1-0

_wtoi
wcstoul
atoi

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s
_wmakepath_s
_wfullpath

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_cexit
_seh_filter_dll
_execute_onexit_table
_configure_narrow_argv
_initterm
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit

api-ms-win-core-errorhandling-l1-1-1

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
GetProcAddress
FreeLibrary
DisableThreadLibraryCalls
FindResourceExW
LoadResource
LoadLibraryExW
SizeofResource
LockResource

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegDeleteKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegCreateKeyExW
RegQueryValueExW

oleaut32

SafeArrayCreateVector
SafeArrayPutElement
VariantCopy
VariantClear
UnRegisterTypeLi
LoadTypeLibEx
SysAllocString
SysFreeString
SysAllocStringLen

api-ms-win-core-sysinfo-l1-2-1

GetSystemInfo
GetSystemTimeAsFileTime

api-ms-win-core-synch-l1-2-0

WaitForSingleObjectEx
SetEvent
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
DeleteCriticalSection
InitializeCriticalSection
InitializeConditionVariable
ResetEvent
LeaveCriticalSection
EnterCriticalSection
WakeAllConditionVariable
SleepConditionVariableCS

api-ms-win-core-localization-l1-2-1

LCMapStringW

api-ms-win-core-file-l1-2-1

SetFilePointer
SetFileAttributesW
GetFullPathNameW
GetFileSize
CreateFileW
DeleteFileW
GetFileType
ReadFile
SetEndOfFile
SetFilePointerEx
WriteFile
GetFileAttributesW

api-ms-win-core-memory-l1-1-2

MapViewOfFile
VirtualAlloc
UnmapViewOfFile
VirtualFree
CreateFileMappingW
MapViewOfFileEx
FlushViewOfFile

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-rtlsupport-l1-2-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-2-0

InitializeSListHead

api-ms-win-core-debug-l1-1-1

IsDebuggerPresent

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree
LocalAlloc

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-environment-l1-1-0

_wdupenv_s

api-ms-win-crt-multibyte-l1-1-0

_mbscmp

api-ms-win-core-file-l2-1-1

CopyFileExW

api-ms-win-core-io-l1-1-1

DeviceIoControl

rpcrt4

UuidCreate

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
VSDllRegisterServer
VSDllUnregisterServer

Sections

.text
Size: 815KB - Virtual size: 814KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 192KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.giats
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

851005084f75ce74de8a81847d16fd03

Code Sign

33:00:00:00:74:f0:1e:99:d0:2a:28:6a:ca:00:00:00:00:00:74Certificate

Extended Key Usages

33:00:00:00:0b:fc:f9:8e:58:4c:15:50:bf:00:00:00:00:00:0bCertificate

Key Usages

c8:52:d5:b7:81:a7:bd:a7:30:fa:5c:44:58:69:bc:fb:03:96:8d:b0:ac:5a:7c:7d:0e:b3:33:e2:3e:e7:d2:06Signer

Headers

DLL Characteristics

File Characteristics

Imports

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-registry-l1-1-0

oleaut32

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-memory-l1-1-2

api-ms-win-core-handle-l1-1-0

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-2-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-core-file-l2-1-1

api-ms-win-core-io-l1-1-1

rpcrt4

api-ms-win-core-processenvironment-l1-2-0

Exports

Exports

Sections

.text Size: 815KB - Virtual size: 814KB

.rdata Size: 192KB - Virtual size: 192KB

.data Size: 12KB - Virtual size: 16KB

.pdata Size: 61KB - Virtual size: 60KB

.gfids Size: 512B - Virtual size: 24B

.tls Size: 512B - Virtual size: 9B

.giats Size: 512B - Virtual size: 8B

.rsrc Size: 63KB - Virtual size: 62KB

.reloc Size: 17KB - Virtual size: 16KB

33:00:00:00:74:f0:1e:99:d0:2a:28:6a:ca:00:00:00:00:00:74
Certificate

33:00:00:00:0b:fc:f9:8e:58:4c:15:50:bf:00:00:00:00:00:0b
Certificate

c8:52:d5:b7:81:a7:bd:a7:30:fa:5c:44:58:69:bc:fb:03:96:8d:b0:ac:5a:7c:7d:0e:b3:33:e2:3e:e7:d2:06
Signer

.text
Size: 815KB - Virtual size: 814KB

.rdata
Size: 192KB - Virtual size: 192KB

.data
Size: 12KB - Virtual size: 16KB

.pdata
Size: 61KB - Virtual size: 60KB

.gfids
Size: 512B - Virtual size: 24B

.tls
Size: 512B - Virtual size: 9B

.giats
Size: 512B - Virtual size: 8B

.rsrc
Size: 63KB - Virtual size: 62KB

.reloc
Size: 17KB - Virtual size: 16KB