NEAS[.]1312daecfcecde6d40fa50e0f4f497f0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.1312daecfcecde6d40fa50e0f4f497f0.exe
Size

133KB
MD5

1312daecfcecde6d40fa50e0f4f497f0
SHA1

30b7fe799a1f713942d5f6ad7ccd3b1a4989dbe0
SHA256

0389801a1c204b6485645ab69f264aaa2f5926ba1824bf2651e73f2028c7ddf5
SHA512

7e238fa2ee727b1724c177014e2d388832982489b59fd1b949c0bef586763067cd81d72a2ebe5274da1a86b231dcdd4fcff312ee88c2aa78cd077979baa96c42
SSDEEP

1536:SmhEqF5kCOjJylzvMaMrHo4hk5//86HIEExJj2ItEKsaEGBrG/KJaeCC:FEqFGJGNBboPJj/tEKsaxJGyUo

Score

1^/10

Malware Config

Signatures

Files

NEAS.1312daecfcecde6d40fa50e0f4f497f0.exe
.exe windows:4 windows x86

ac6dacb17bbccbcf37abfabb313ec7d6

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

79:b2:db:f5:2e:a4:f4:c5:18:4b:6e:9a:3f:22:05:e4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

07/05/2010, 00:00

Not After

19/05/2012, 23:59

Subject

CN=Thermo Fisher Scientific Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Thermo Fisher Scientific Inc.,L=Madison,ST=Wisconsin,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

e6:8c:08:4d:93:2c:75:24:b7:ae:99:46:41:76:db:2a:df:e9:87:d3
Signer

Actual PE Digest

e6:8c:08:4d:93:2c:75:24:b7:ae:99:46:41:76:db:2a:df:e9:87:d3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

kernel32

GetLocaleInfoA
FindClose
FindFirstFileA
GetCurrentProcess
GetCurrentThread
Process32Next
OpenProcess
Process32First
CreateToolhelp32Snapshot
lstrlenA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
ExpandEnvironmentStringsA
Sleep
GetTickCount
FreeLibrary
SetErrorMode
GetProcAddress
LoadLibraryA
GetSystemTimeAsFileTime
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetStringTypeW
GetStringTypeA
GetModuleHandleA
GetModuleFileNameA
CreateMutexA
GetLastError
CloseHandle
WideCharToMultiByte
MultiByteToWideChar
InitializeCriticalSection
GetCPInfo
GetUserDefaultLCID
GetVersionExA
LCMapStringW
LCMapStringA
HeapSize
GetConsoleMode
GetConsoleCP
SetFilePointer
GetCurrentProcessId
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
InterlockedExchange
GetACP
GetThreadLocale
FreeEnvironmentStringsW
LocalFree
HeapFree
HeapAlloc
RaiseException
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
RtlUnwind
GetCommandLineA
GetProcessHeap
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
ExitProcess
WriteFile
GetStdHandle
SetUnhandledExceptionFilter
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
FreeEnvironmentStringsA
GetEnvironmentStrings
GetOEMCP

user32

wsprintfA
GetDlgItem
SetWindowPos
MoveWindow
LoadStringA
SetWindowTextA
EnableWindow
DialogBoxParamA
SetFocus
EndDialog
UpdateWindow
FindWindowA
GetWindowThreadProcessId
GetClientRect
MessageBoxA
GetWindowRect
ShowWindow

advapi32

FreeSid
RegQueryValueExA
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
GetTokenInformation
EqualSid
OpenThreadToken
OpenProcessToken
AllocateAndInitializeSid

ole32

CoCreateInstance
CLSIDFromProgID
CLSIDFromString
CoUninitialize
CoInitialize
OleRun

oleaut32

VarI4FromStr
SysAllocString
VariantClear
SysFreeString

Sections

.text
Size: 68KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ac6dacb17bbccbcf37abfabb313ec7d6

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

79:b2:db:f5:2e:a4:f4:c5:18:4b:6e:9a:3f:22:05:e4Certificate

Extended Key Usages

Key Usages

e6:8c:08:4d:93:2c:75:24:b7:ae:99:46:41:76:db:2a:df:e9:87:d3Signer

Headers

File Characteristics

Imports

version

kernel32

user32

advapi32

ole32

oleaut32

Sections

.text Size: 68KB - Virtual size: 65KB

.rdata Size: 16KB - Virtual size: 13KB

.data Size: 8KB - Virtual size: 12KB

.rsrc Size: 32KB - Virtual size: 28KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

79:b2:db:f5:2e:a4:f4:c5:18:4b:6e:9a:3f:22:05:e4
Certificate

e6:8c:08:4d:93:2c:75:24:b7:ae:99:46:41:76:db:2a:df:e9:87:d3
Signer

.text
Size: 68KB - Virtual size: 65KB

.rdata
Size: 16KB - Virtual size: 13KB

.data
Size: 8KB - Virtual size: 12KB

.rsrc
Size: 32KB - Virtual size: 28KB