NEAS[.]d5635a33cc1b2d5b890248df779eb260[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.d5635a33cc1b2d5b890248df779eb260.exe
Size

239KB
MD5

d5635a33cc1b2d5b890248df779eb260
SHA1

7c21ad005cfa7f3609603c237d208ff6f808ce2d
SHA256

ddd23f4852ffbdf23e34abbd359b73e4fcb13725b30475603b73fdc15a01d247
SHA512

4b22d7d7edf49c95b917f4a4d8954e5d0d5b4e2512c48bb11581899f159ad6f0181e3d1f6c081834f41823b55ab7e71f9040e00e393662a09746b98a28a7adba
SSDEEP

6144:eJVrno90DDvPuUFp7VfeNl3QQFA/wp4vGOmkW3fte:IZno9uDvP1doQQFA/wp4vDxWfte

Score

1^/10

Malware Config

Signatures

Files

NEAS.d5635a33cc1b2d5b890248df779eb260.exe
.dll windows:5 windows x86

6274ad843cc7419022f793822344f5a1

Code Sign

54:19:e3:2f:da:d7:a6:e5:66:6a:35:06:6c:5e:aa:c5
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

09/01/2013, 00:00

Not After

09/01/2014, 23:59

Subject

CN=Innovative Apps,O=Innovative Apps,L=Philadelphia,ST=Pennsylvania,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

17/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f3:a7:34:72:9f:73:15:79:fb:f1:14:30:c9:e0:b8:ad:53:cc:46:6a
Signer

Actual PE Digest

f3:a7:34:72:9f:73:15:79:fb:f1:14:30:c9:e0:b8:ad:53:cc:46:6a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

wininet

HttpOpenRequestA
InternetConnectA
InternetCloseHandle
InternetCrackUrlA
InternetSetOptionA
InternetOpenA
HttpSendRequestA

kernel32

CloseHandle
WaitForSingleObject
ReleaseMutex
CreateThread
GetLastError
GetModuleFileNameA
ExpandEnvironmentStringsA
CreateFileA
ReadFile
SetLastError
LocalFree
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GlobalFlags
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
SetEvent
lstrcpyA
CreateEventA
CreateFileMappingA
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
GetCurrentProcess
LocalAlloc
WriteFile
SetFilePointer
OpenMutexA
FindResourceA
FreeLibrary
LoadResource
SizeofResource
IsDBCSLeadByte
lstrlenW
RaiseException
lstrcmpiA
LoadLibraryExA
GetCurrentProcessId
Sleep
GetLocalTime
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
HeapReAlloc
VirtualProtect
VirtualAlloc
GetModuleHandleW
GetSystemInfo
VirtualQuery
GetCommandLineA
RtlUnwind
LCMapStringW
GetCPInfo
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapSize
ExitProcess
GetACP
GetOEMCP
GetFileType
IsValidCodePage
TlsAlloc
CreateMutexA
WideCharToMultiByte
GetModuleHandleA
GetProcAddress
GetVersion
GetCurrentThreadId
OutputDebugStringA
DebugBreak
InterlockedIncrement
InterlockedDecrement
lstrlenA
LoadLibraryW
WriteConsoleW
GetStdHandle
SetHandleCount
SetStdHandle
CreateFileW
SetEndOfFile
GetProcessHeap
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
GetStartupInfoW
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
InitializeCriticalSection
EncodePointer
DecodePointer
QueryPerformanceCounter
GetStringTypeW

user32

DestroyWindow
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowPos
GetWindowRect
ReleaseDC
GetDC
DestroyIcon
PostMessageA
GetParent
InvalidateRect
GetWindowThreadProcessId
GetDesktopWindow
SendMessageA
FindWindowExA
CharNextA
wvsprintfA
LoadStringA

gdi32

SelectObject
CreateFontA
DeleteObject
GetObjectA
GetTextExtentPoint32A

advapi32

RegSetValueExA
RegOpenKeyExA
RegDeleteKeyA
RegEnumKeyExA
OpenProcessToken
GetTokenInformation
RegDeleteValueA
RegQueryInfoKeyW
RegCloseKey
RegQueryValueExA
RegCreateKeyExA
GetSidSubAuthority
GetSidSubAuthorityCount

shell32

SHGetFolderPathA

ole32

CoCreateInstance
CreateStreamOnHGlobal
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

VariantClear
VarUI4FromStr

comctl32

ImageList_GetImageCount
ImageList_ReplaceIcon
ImageList_Remove

gdiplus

GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDrawImageRectI
GdipMeasureString
GdipDrawString
GdipFillPath
GdipGraphicsClear
GdipDrawPath
GdipSetInterpolationMode
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipSetPathGradientFocusScales
GdipSetPathGradientSurroundColorsWithCount
GdipSetPathGradientCenterColor
GdipCreatePathGradientFromPath
GdipWindingModeOutline
GdipAddPathEllipseI
GdipAddPathRectangleI
GdipDeletePath
GdipCreatePath
GdipSetStringFormatTrimming
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeletePen
GdipCreatePen1
GdipDisposeImage
GdipCreateSolidFill
GdipCloneBrush
GdipDeleteBrush
GdipAlloc
GdipFree
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipCreateHICONFromBitmap
GdipCloneBitmapAreaI
GdiplusStartup
GdiplusShutdown
GdipGetPathGradientPointCount

Sections

.text
Size: 172KB - Virtual size: 172KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6274ad843cc7419022f793822344f5a1

Code Sign

54:19:e3:2f:da:d7:a6:e5:66:6a:35:06:6c:5e:aa:c5Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6dCertificate

Key Usages

f3:a7:34:72:9f:73:15:79:fb:f1:14:30:c9:e0:b8:ad:53:cc:46:6aSigner

Headers

DLL Characteristics

File Characteristics

Imports

version

wininet

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

gdiplus

Sections

.text Size: 172KB - Virtual size: 172KB

.rdata Size: 35KB - Virtual size: 35KB

.data Size: 7KB - Virtual size: 15KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 19KB - Virtual size: 18KB

54:19:e3:2f:da:d7:a6:e5:66:6a:35:06:6c:5e:aa:c5
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

f3:a7:34:72:9f:73:15:79:fb:f1:14:30:c9:e0:b8:ad:53:cc:46:6a
Signer

.text
Size: 172KB - Virtual size: 172KB

.rdata
Size: 35KB - Virtual size: 35KB

.data
Size: 7KB - Virtual size: 15KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 19KB - Virtual size: 18KB