67a97e75d3d0113c81e86a6415c0a860_NEAS

Sharing

Copy URL Twitter E-mail

General

Target

67a97e75d3d0113c81e86a6415c0a860_NEAS
Size

1.5MB
MD5

67a97e75d3d0113c81e86a6415c0a860
SHA1

aca6e3389ddc762fbf15541c6acb99c11b074480
SHA256

4a9e412d7f99bee75513ce9753a044394bccdb33cda32965ff04962230cc7753
SHA512

0537e456fedd0a075907df19e9b75afe228fa49161b0b0874ca3a750508d497f0656936852808a02037d98e471a1d7d617c1605509cb9e548f39cc193436a95a
SSDEEP

12288:Zj4eamhFTirO96xe5Ml7utyoaKGq14Qg2nT54TOt:Z0ea2iC96k5Mloy3KN4QznTS8

Score

1^/10

Malware Config

Signatures

Files

67a97e75d3d0113c81e86a6415c0a860_NEAS
.exe windows:6 windows x86 arch:x86

305aec2a7b537b125e37ac31a6d8d20c

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

29:8d:39:be:2f:4b:49:25:1e:3e:89:22
Certificate

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

11/07/2023, 13:01

Not After

07/10/2026, 13:01

Subject

CN=Sven Ritter,O=Sven Ritter,L=Varel,ST=Niedersachsen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

29:8d:39:be:2f:4b:49:25:1e:3e:89:22
Certificate

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

11/07/2023, 13:01

Not After

07/10/2026, 13:01

Subject

CN=Sven Ritter,O=Sven Ritter,L=Varel,ST=Niedersachsen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

d6:a9:0e:91:04:05:6b:43:bd:0b:75:a7:ac:e7:98:0a:7f:2b:45:e9:d1:36:14:76:f0:45:a2:94:c4:1e:0c:32
Signer

Actual PE Digest

d6:a9:0e:91:04:05:6b:43:bd:0b:75:a7:ac:e7:98:0a:7f:2b:45:e9:d1:36:14:76:f0:45:a2:94:c4:1e:0c:32

Digest Algorithm

sha256

PE Digest Matches

true

33:3f:34:dc:c4:45:f6:9c:3b:9e:d9:ac:46:a6:ee:33:83:1b:f6:a4
Signer

Actual PE Digest

33:3f:34:dc:c4:45:f6:9c:3b:9e:d9:ac:46:a6:ee:33:83:1b:f6:a4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\Visual C++\Release\SpeedCommander\20.x\20.5x\[OutDir]\x32#Release\SpeedCommander\fsc\fsc.pdb

Imports

mxbase

ord3806
ord3818
ord2106
ord2230
ord2234
ord2228
ord1307
ord1337
ord3535
ord3992
ord4073
ord8903
ord9323
ord44
ord56
ord54
ord57
ord5733
ord51
ord1440
ord1445
ord2643
ord4874
ord2650
ord7097
ord7121
ord8986
ord3668
ord4506
ord5643
ord11192
ord1341
ord65
ord2512
ord7094
ord2642
ord1054
ord30
ord24
ord40
ord3534
ord7058
ord7053
ord7044
ord7043
ord9607
ord4517
ord4876
ord11183
ord70
ord6892
ord6644
ord64
ord68
ord8805
ord6740
ord7049
ord2506
ord6693
ord9002
ord1883
ord3669
ord9000
ord2497
ord1919
ord1344
ord9057
ord7095
ord10384
ord10378
ord7143
ord7144
ord9123
ord3805
ord6992
ord69
ord66
ord1343
ord11182
ord3536
ord6664
ord2294
ord9001
ord6918
ord3349
ord6663
ord60
ord5045
ord681
ord1059
ord1063
ord3709
ord71
ord10372
ord8925
ord4927
ord2659
ord10299
ord1444
ord48
ord8673
ord2115
ord9202
ord1067
ord3350
ord72
ord680
ord36
ord4873
ord1335
ord4537
ord5655
ord10524
ord8781
ord2573
ord2725
ord8457
ord682
ord63
ord684
ord5751
ord5044
ord10425
ord6797
ord4192
ord2295
ord1346
ord74
ord75
ord1066
ord683
ord5688

kernel32

GetNativeSystemInfo
LCMapStringEx
GetCPInfo
CompareStringEx
EncodePointer
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
SubmitThreadpoolWork
CreateThreadpoolWork
TryAcquireSRWLockExclusive
GetStringTypeW
RaiseException
OutputDebugStringW
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetConsoleCP
ExitProcess
GetModuleHandleExW
WriteFile
GetCommandLineA
GetCommandLineW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
GetConsoleMode
SetConsoleMode
GetNumberOfConsoleInputEvents
ReadConsoleInputW
PeekConsoleInputA
ReadConsoleW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
SetFilePointerEx
GetConsoleOutputCP
ReadFile
SetErrorMode
GetModuleHandleW
LocalFree
FormatMessageW
DecodePointer
GetLastError
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
CreateDirectoryW
CreateFileW
SetFileAttributesW
CloseHandle
DeviceIoControl
GetSystemTimeAsFileTime
GetTickCount64
DosDateTimeToFileTime
GetLocalTime
lstrlenW
GetDateFormatW
GetTimeFormatW
CompareFileTime
FindClose
FindFirstFileW
SetLastError
lstrlenA
GetStdHandle
WriteConsoleW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
FlushFileBuffers
GetFileAttributesW
DisconnectNamedPipe
CallNamedPipeW
Sleep
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetProcessId
GetModuleFileNameW
GetProcAddress
GetPrivateProfileIntW
EnterCriticalSection
LeaveCriticalSection
lstrcmpW
CopyFileExW
FindFirstFileExW
FindNextFileW
InitializeCriticalSection
CreateFileMappingW
MapViewOfFile
LoadLibraryExA
WideCharToMultiByte
MultiByteToWideChar
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
SetEndOfFile
GetSystemInfo
VirtualProtect
VirtualQuery
UnmapViewOfFile

user32

CharUpperW
RegisterWindowMessageW
SendMessageTimeoutW
CharLowerA
OemToCharBuffA
CharToOemBuffA
CharUpperA
SetWindowLongW
DestroyWindow
CreateWindowExW
GetClassInfoW
RegisterClassW
DefWindowProcW
GetWindow
GetWindowThreadProcessId
EnumWindows
FindWindowExW
GetParent
GetWindowLongW
IsWindowVisible

advapi32

GetNamedSecurityInfoW
SetNamedSecurityInfoW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
CopySid
GetLengthSid
GetSidLengthRequired
GetSidSubAuthority
SetEntriesInAclW
InitializeSid
IsValidSid
OpenProcessToken
AccessCheck
AdjustTokenPrivileges
DuplicateToken
GetFileSecurityW
GetTokenInformation
MapGenericMask
LookupPrivilegeValueW
RegGetValueW
SetFileSecurityW

shell32

ShellExecuteExW
SHGetFileInfoW
ord155
SHGetDesktopFolder

shlwapi

PathIsUNCW
PathIsRelativeW
PathCompactPathExW
PathAppendW
PathRemoveFileSpecW
PathFindExtensionW
SHCreateStreamOnFileW

ole32

CoCreateInstance
CoSetProxyBlanket
CoInitialize
CoUninitialize
CoInitializeSecurity

Sections

.text
Size: 337KB - Virtual size: 336KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.sstb
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

305aec2a7b537b125e37ac31a6d8d20c

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47Certificate

Extended Key Usages

Key Usages

29:8d:39:be:2f:4b:49:25:1e:3e:89:22Certificate

Extended Key Usages

Key Usages

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47Certificate

Extended Key Usages

Key Usages

29:8d:39:be:2f:4b:49:25:1e:3e:89:22Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

d6:a9:0e:91:04:05:6b:43:bd:0b:75:a7:ac:e7:98:0a:7f:2b:45:e9:d1:36:14:76:f0:45:a2:94:c4:1e:0c:32Signer

33:3f:34:dc:c4:45:f6:9c:3b:9e:d9:ac:46:a6:ee:33:83:1b:f6:a4Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mxbase

kernel32

user32

advapi32

shell32

shlwapi

ole32

Sections

.text Size: 337KB - Virtual size: 336KB

.rdata Size: 69KB - Virtual size: 68KB

.data Size: 10KB - Virtual size: 112KB

.rsrc Size: 41KB - Virtual size: 40KB

.reloc Size: 14KB - Virtual size: 14KB

.sstb Size: 1.0MB - Virtual size: 1.0MB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

29:8d:39:be:2f:4b:49:25:1e:3e:89:22
Certificate

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

29:8d:39:be:2f:4b:49:25:1e:3e:89:22
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

d6:a9:0e:91:04:05:6b:43:bd:0b:75:a7:ac:e7:98:0a:7f:2b:45:e9:d1:36:14:76:f0:45:a2:94:c4:1e:0c:32
Signer

33:3f:34:dc:c4:45:f6:9c:3b:9e:d9:ac:46:a6:ee:33:83:1b:f6:a4
Signer

.text
Size: 337KB - Virtual size: 336KB

.rdata
Size: 69KB - Virtual size: 68KB

.data
Size: 10KB - Virtual size: 112KB

.rsrc
Size: 41KB - Virtual size: 40KB

.reloc
Size: 14KB - Virtual size: 14KB

.sstb
Size: 1.0MB - Virtual size: 1.0MB