NEAS[.]863e3bb35d7d5f51cf849098578d03e0[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.863e3bb35d7d5f51cf849098578d03e0.exe
Size

204KB
MD5

863e3bb35d7d5f51cf849098578d03e0
SHA1

34ff7245a4158bfdee1899e93b6f2fc76ca2cdb9
SHA256

d34a18ef1dc8a884fa49790355da5f0244fa71826e667bfb8d2605b63d3f7d98
SHA512

98e36fe7a29da004ce2d4ea1efa06ace1150884a1412be96f52b8cfce5c51278b81609ce9a0a4f80414c9380019ca6aa2ce64d9205abe74740acd579165ca981
SSDEEP

3072:7HEIQc1ybmsd9Ig2V4Qn3WnzqaCPvpBKazQ/2lQBV+UdE+rECWp7hKyc1:7HL1ybmw9rl0TzQDBV+UdvrEFp7hKyc1

Score

1^/10

Malware Config

Signatures

Files

NEAS.863e3bb35d7d5f51cf849098578d03e0.exe
.dll regsvr32 windows:10 windows x86 arch:x86

7ad4dde06ad0e4288411890abe848abe

Code Sign

33:00:00:00:b5:ac:7d:6d:87:6b:26:11:47:00:00:00:00:00:b5
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07-09-2016 17:58

Not After

07-09-2018 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-08-2016 20:17

Not After

02-11-2017 20:17

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03-04-2007 12:53

Not After

03-04-2021 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:4f:e7:c6:62:c9:46:f4:a9:7f:00:00:00:00:01:4f
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

17-11-2016 21:59

Not After

17-02-2018 21:59

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-07-2010 20:40

Not After

06-07-2025 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

32:72:67:8f:b8:18:68:f1:8e:11:3c:b3:7c:0e:38:b6:52:cc:ba:27:9e:07:c9:f8:bd:32:dd:ac:e4:47:b3:8f
Signer

Actual PE Digest

32:72:67:8f:b8:18:68:f1:8e:11:3c:b3:7c:0e:38:b6:52:cc:ba:27:9e:07:c9:f8:bd:32:dd:ac:e4:47:b3:8f

Digest Algorithm

sha256

PE Digest Matches

false

72:da:91:86:70:8c:71:2f:86:52:8e:f3:49:ae:50:b1:e2:a9:2f:60
Signer

Actual PE Digest

72:da:91:86:70:8c:71:2f:86:52:8e:f3:49:ae:50:b1:e2:a9:2f:60

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

Imports

msvcrt

??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
_vscwprintf
vswprintf_s
_purecall
calloc
?what@exception@@UBEPBDXZ
??0exception@@QAE@XZ
_callnewh
memmove_s
_XcptFilter
_amsg_exit
_initterm
memcpy_s
malloc
wcsncpy_s
?terminate@@YAXXZ
_except_handler4_common
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UAE@XZ
_errno
realloc
wcscat_s
__CxxFrameHandler3
_wcsnicmp
wcschr
_wcsicmp
wcsrchr
_vsnwprintf
wcscpy_s
_CxxThrowException
free
memset
memcmp
__RTDynamicCast
memcpy

api-ms-win-downlevel-kernel32-l1-1-0

SizeofResource
MultiByteToWideChar
SetEnvironmentVariableW
LockResource
GetVersionExW
SetThreadUILanguage
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
CompareStringW
GetCurrentProcessId
GetCurrentThreadId
HeapDestroy
GetProcessHeap
HeapAlloc
OutputDebugStringW
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleW
LoadLibraryExW
GetProcAddress
GetModuleFileNameW
GetLastError
RaiseException
DeleteCriticalSection
SetThreadLocale
GetThreadLocale
DisableThreadLibraryCalls
HeapFree
HeapReAlloc
HeapSize
FindResourceExW
OutputDebugStringA
ExpandEnvironmentStringsW
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
GetCurrentDirectoryW
WaitForSingleObject
InitializeCriticalSection
SetFileAttributesW
DeviceIoControl
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
SetLastError
LoadResource
SearchPathW

api-ms-win-downlevel-user32-l1-1-1

CharLowerBuffW
LoadStringW
CharNextW

api-ms-win-downlevel-advapi32-l1-1-1

RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW
AdjustTokenPrivileges

api-ms-win-downlevel-ole32-l1-1-1

CreateErrorInfo
ProgIDFromCLSID
CoTaskMemFree
CoCreateInstance
StringFromGUID2
SetErrorInfo

oleaut32

LoadRegTypeLi
SysAllocStringLen
VariantClear
VarBstrCat
SysAllocStringByteLen
SysStringByteLen
VarBstrCmp
SysStringLen
RegisterTypeLi
LoadTypeLi
SysAllocString
UnRegisterTypeLi
SysFreeString

kernel32

ReadFile
GetFileAttributesW
SetFilePointer
FreeLibrary
FindClose
FindNextFileW
FindFirstFileW
GetFileInformationByHandle
CreateDirectoryW
CloseHandle
GetFullPathNameW
CreateFileW
LocalFree
GetNativeSystemInfo
FormatMessageW

advapi32

OpenProcessToken

ole32

StringFromCLSID
CoCreateGuid

api-ms-win-downlevel-version-l1-1-0

VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW

ntdll

RtlFreeHeap
RtlNtStatusToDosError
NtSetInformationFile
RtlAllocateHeap

Exports

Exports

DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7ad4dde06ad0e4288411890abe848abe

Code Sign

33:00:00:00:b5:ac:7d:6d:87:6b:26:11:47:00:00:00:00:00:b5Certificate

Extended Key Usages

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40Certificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:01:4f:e7:c6:62:c9:46:f4:a9:7f:00:00:00:00:01:4fCertificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

32:72:67:8f:b8:18:68:f1:8e:11:3c:b3:7c:0e:38:b6:52:cc:ba:27:9e:07:c9:f8:bd:32:dd:ac:e4:47:b3:8fSigner

72:da:91:86:70:8c:71:2f:86:52:8e:f3:49:ae:50:b1:e2:a9:2f:60Signer

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-downlevel-kernel32-l1-1-0

api-ms-win-downlevel-user32-l1-1-1

api-ms-win-downlevel-advapi32-l1-1-1

api-ms-win-downlevel-ole32-l1-1-1

oleaut32

kernel32

advapi32

ole32

api-ms-win-downlevel-version-l1-1-0

ntdll

Exports

Exports

Sections

.text Size: 83KB - Virtual size: 83KB

.data Size: 5KB - Virtual size: 5KB

.idata Size: 4KB - Virtual size: 3KB

.rsrc Size: 13KB - Virtual size: 12KB

.reloc Size: 6KB - Virtual size: 6KB

33:00:00:00:b5:ac:7d:6d:87:6b:26:11:47:00:00:00:00:00:b5
Certificate

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:01:4f:e7:c6:62:c9:46:f4:a9:7f:00:00:00:00:01:4f
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

32:72:67:8f:b8:18:68:f1:8e:11:3c:b3:7c:0e:38:b6:52:cc:ba:27:9e:07:c9:f8:bd:32:dd:ac:e4:47:b3:8f
Signer

72:da:91:86:70:8c:71:2f:86:52:8e:f3:49:ae:50:b1:e2:a9:2f:60
Signer

.text
Size: 83KB - Virtual size: 83KB

.data
Size: 5KB - Virtual size: 5KB

.idata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 13KB - Virtual size: 12KB

.reloc
Size: 6KB - Virtual size: 6KB