NEAS[.]e5cb35606e5ef83246e0e3e02c81b930[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.e5cb35606e5ef83246e0e3e02c81b930.exe
Size

889KB
MD5

e5cb35606e5ef83246e0e3e02c81b930
SHA1

2770c775d2fd9eb4443a6cb6185c26baa15c636e
SHA256

95bc6ec58d0aad6c067d33ba8b700fe9a071fd2f3f96e442126c795614af1579
SHA512

5b3d37ec96f0c5643c41150f7f5197259a1a4e062a98cd8c6ca8dc061f45510ab0c4a4918fb4b6139c110cdb2dab26bb0be9bc5e4e4061a131ddc31146c77074
SSDEEP

24576:+dWwlJ3JIsblJK6L4L+yItjTqE/ONwJY6roUIX:YFIsblNC+yItjTqE58UIX

Score

1^/10

Malware Config

Signatures

Files

NEAS.e5cb35606e5ef83246e0e3e02c81b930.exe
.dll windows:5 windows x64

2f5d35cfd835c8348983393d9984db76

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6c:6e:17:6d:15:8e:ee:bf:df:0f:15:e4:8f:25:df:30
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

09-01-2015 00:00

Not After

07-02-2018 23:59

Subject

CN=Shenzhen Excelsecu Data Technology Co.\,ltd.,OU=Technical Support Department,O=Shenzhen Excelsecu Data Technology Co.\,ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3c:5b:e5:a1:8d:b1:ba:9b:ad:4d:b9:a2:e2:dc:de:03:78:c9:4e:1c
Signer

Actual PE Digest

3c:5b:e5:a1:8d:b1:ba:9b:ad:4d:b9:a2:e2:dc:de:03:78:c9:4e:1c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

advapi32

RegQueryValueExA
RegQueryValueExW
RegOpenKeyA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
DeregisterEventSource
ReportEventW
RegisterEventSourceW
SetSecurityInfo
GetLengthSid
FreeSid
AddAccessAllowedAce
AllocateAndInitializeSid
InitializeAcl
GetSecurityDescriptorSacl

ole32

CoCreateGuid
CoUninitialize
CoInitialize

user32

GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW

rpcrt4

UuidToStringA
UuidCreate
RpcStringFreeA

kernel32

GetDateFormatA
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetModuleFileNameA
CloseHandle
ReleaseMutex
WaitForSingleObject
GetCurrentProcessId
GetCurrentThreadId
DisableThreadLibraryCalls
Sleep
CreateMutexW
GetExitCodeThread
GetLastError
SetLastError
GetProcAddress
GetModuleFileNameW
LoadLibraryW
FreeLibrary
WideCharToMultiByte
GetVersion
MultiByteToWideChar
GetFileType
GetStdHandle
GetTickCount
QueryPerformanceCounter
GlobalMemoryStatus
GetVersionExW
LoadLibraryA
VirtualQuery
SystemTimeToFileTime
SetEvent
CreateEventW
GetSystemTime
CreateMutexA
GetHandleInformation
OutputDebugStringA
OpenMutexA
HeapFree
GetProcessHeap
CreateEventA
ResetEvent
OpenEventA
TerminateThread
CreateThread
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
OpenFileMappingA
CreateFileA
HeapAlloc
GetModuleHandleW
GetModuleHandleA
LocalFree
ExitThread
GetSystemTimeAsFileTime
GetTimeFormatA
ExitProcess
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlCaptureContext
HeapReAlloc
FlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
FlsAlloc
LCMapStringA
LCMapStringW
WriteFile
HeapSetInformation
HeapCreate
HeapDestroy
RtlUnwindEx
GetTimeZoneInformation
SetHandleCount
GetStartupInfoA
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
FlushFileBuffers
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
ReadFile
SetStdHandle
SetFilePointer
RaiseException
RtlPcToFileHeader
GetStringTypeA
GetStringTypeW
GetLocaleInfoA

Exports

Exports

C_CancelFunction
C_CloseAllSessions
C_CloseSession
C_CopyObject
C_CreateObject
C_Decrypt
C_DecryptDigestUpdate
C_DecryptFinal
C_DecryptInit
C_DecryptUpdate
C_DecryptVerifyUpdate
C_DeriveKey
C_DestroyObject
C_Digest
C_DigestEncryptUpdate
C_DigestFinal
C_DigestInit
C_DigestKey
C_DigestUpdate
C_Encrypt
C_EncryptFinal
C_EncryptInit
C_EncryptUpdate
C_Finalize
C_FindObjects
C_FindObjectsFinal
C_FindObjectsInit
C_GenerateKey
C_GenerateKeyPair
C_GenerateRandom
C_GetAttributeValue
C_GetFunctionList
C_GetFunctionStatus
C_GetInfo
C_GetMechanismInfo
C_GetMechanismList
C_GetObjectSize
C_GetOperationState
C_GetSessionInfo
C_GetSlotInfo
C_GetSlotList
C_GetTokenInfo
C_InitPIN
C_InitToken
C_Initialize
C_Login
C_Logout
C_OpenSession
C_SeedRandom
C_SetAttributeValue
C_SetOperationState
C_SetPIN
C_SetTokenInfo
C_Sign
C_SignEncryptUpdate
C_SignFinal
C_SignInit
C_SignRecover
C_SignRecoverInit
C_SignUpdate
C_UnwrapKey
C_Verify
C_VerifyFinal
C_VerifyInit
C_VerifyRecover
C_VerifyRecoverInit
C_VerifyUpdate
C_WaitForSlotEvent
C_WrapKey

Sections

.text
Size: 583KB - Virtual size: 582KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 165KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 71KB - Virtual size: 4.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2f5d35cfd835c8348983393d9984db76

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

6c:6e:17:6d:15:8e:ee:bf:df:0f:15:e4:8f:25:df:30Certificate

Extended Key Usages

Key Usages

3c:5b:e5:a1:8d:b1:ba:9b:ad:4d:b9:a2:e2:dc:de:03:78:c9:4e:1cSigner

Headers

File Characteristics

Imports

advapi32

ole32

user32

rpcrt4

kernel32

Exports

Exports

Sections

.text Size: 583KB - Virtual size: 582KB

.rdata Size: 165KB - Virtual size: 165KB

.data Size: 71KB - Virtual size: 4.3MB

.pdata Size: 33KB - Virtual size: 33KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 27KB - Virtual size: 26KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

6c:6e:17:6d:15:8e:ee:bf:df:0f:15:e4:8f:25:df:30
Certificate

3c:5b:e5:a1:8d:b1:ba:9b:ad:4d:b9:a2:e2:dc:de:03:78:c9:4e:1c
Signer

.text
Size: 583KB - Virtual size: 582KB

.rdata
Size: 165KB - Virtual size: 165KB

.data
Size: 71KB - Virtual size: 4.3MB

.pdata
Size: 33KB - Virtual size: 33KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 27KB - Virtual size: 26KB