1fb5ac962fff3f3ad395677edb2fdd90_NEAS

Sharing

Copy URL

Twitter E-mail

General

Target

1fb5ac962fff3f3ad395677edb2fdd90_NEAS
Size

1.7MB
MD5

1fb5ac962fff3f3ad395677edb2fdd90
SHA1

dcac3f3d19c9c783e2aace00e8c1546b529f95eb
SHA256

41c179aff659bbc1bb8296fedeb888f436192ff12439c3176cb19795fbb23b7d
SHA512

991770f50d08358a36636b760cbc85a16a77027895f60bd73c6c6ae82ffdae5eac9d4780e320738cf3d163097d95f3e471dc2a44c5d73d2791cd96c604fe7b4e
SSDEEP

24576:9+wp56ecmB1idxN383NKAl4GptVctXRzVNiG34UB7pd8HFBiYk4JujwetFi8EbUb:dr6ecmB1idxN38wVNimPNp7tFi8nD

Score

1^/10

Malware Config

Signatures

Files

1fb5ac962fff3f3ad395677edb2fdd90_NEAS
.dll windows:5 windows x64 arch:x64

51dcb9e351489e3c75db9c583e4f741e

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:ea:0d:de:d5:5e:c1:e1:a2:9f:c5:fb:5d:ab:4f:b2
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19-05-2020 00:00

Not After

18-05-2023 12:00

Subject

SERIALNUMBER=91310115591679552Q,CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,ST=Shanghai,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21-09-2022 00:00

Not After

21-11-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

05:aa:43:30:0d:17:67:ac:12:49:43:54:21:65:bb:9e
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19-05-2020 00:00

Not After

18-05-2023 12:00

Subject

SERIALNUMBER=91310115591679552Q,CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,ST=Shanghai,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21-09-2022 00:00

Not After

21-11-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

65:08:aa:36:91:40:46:7d:8c:6a:e1:41:32:75:59:fa:fa:3a:c2:5d:a5:a8:1e:78:a6:2c:45:35:51:db:fc:5b
Signer

Actual PE Digest

65:08:aa:36:91:40:46:7d:8c:6a:e1:41:32:75:59:fa:fa:3a:c2:5d:a5:a8:1e:78:a6:2c:45:35:51:db:fc:5b

Digest Algorithm

sha256

PE Digest Matches

true

c7:04:68:8e:2d:af:32:1f:11:84:11:7d:e5:cc:9c:a9:c5:9a:b2:47
Signer

Actual PE Digest

c7:04:68:8e:2d:af:32:1f:11:84:11:7d:e5:cc:9c:a9:c5:9a:b2:47

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\RCFL\DirectUI\SVNServer\DirectUI\bin\vs2013\x64\release_unicode\pdb\2345DirectUI.pdb

Imports

kernel32

IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
OutputDebugStringW
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
VirtualAlloc
VirtualFree
lstrlenA
LocalFree
GetProcessHeap
HeapFree
HeapAlloc
GetCurrentThreadId
SetLastError
FlushInstructionCache
ReadFile
FreeLibrary
GetCurrentProcess
SetFilePointer
FreeResource
EncodePointer
DeleteFileW
CopyFileW
CreateEventW
GetTickCount
GetCurrentDirectoryW
WideCharToMultiByte
DisableThreadLibraryCalls
MultiByteToWideChar
SizeofResource
LoadLibraryExW
LoadResource
FindResourceW
IsBadReadPtr
GlobalFree
CreateFileW
WriteFile
DecodePointer
GetLastError
RaiseException
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
GlobalUnlock
GlobalAlloc
GetModuleHandleW
GlobalLock
MulDiv
ExpandEnvironmentStringsW
lstrcpyW
lstrcatW
lstrcmpiW
lstrlenW
GetFileAttributesW
GetVersionExW
LoadLibraryW
CloseHandle
DeleteCriticalSection
LoadLibraryA
EnterCriticalSection
GetProcAddress
LeaveCriticalSection
InitializeCriticalSection
IsDebuggerPresent

user32

FindWindowW
IsRectEmpty
SetRectEmpty
GetMonitorInfoW
MonitorFromWindow
DrawTextW
UnionRect
GetSysColor
EndPaint
ClientToScreen
IsWindow
PtInRect
LoadCursorW
GetParent
SetForegroundWindow
PostMessageW
IsIconic
GetWindowRect
RemovePropW
UpdateLayeredWindow
DestroyWindow
UnregisterClassW
CopyRect
SetCursor
GetIconInfo
DrawIconEx
MoveWindow
SetWindowTextW
GetDlgCtrlID
UpdateWindow
SendMessageW
CloseWindow
GetDlgItem
GetWindowTextW
BringWindowToTop
InvalidateRect
LockWindowUpdate
GetCapture
SetFocus
GetClientRect
SetParent
IsWindowEnabled
IsZoomed
KillTimer
SetCapture
SetActiveWindow
SetTimer
GetWindowTextLengthW
CharNextW
GetWindow
SystemParametersInfoW
MessageBoxW
CallWindowProcW
EndDeferWindowPos
SetWindowLongPtrW
GetSystemMetrics
BeginDeferWindowPos
ReleaseCapture
EqualRect
GetCursorPos
GetDesktopWindow
DestroyCursor
EnableMenuItem
GetClassNameW
GetClassLongPtrW
IntersectRect
OffsetRect
InflateRect
BeginPaint
DrawTextExW
GetWindowLongPtrW
GetKeyState
GetTopWindow
ScreenToClient
GetSystemMenu
FillRect
DrawFrameControl
LoadStringW
LoadImageW
MonitorFromPoint
CallNextHookEx
WindowFromPoint
TrackPopupMenuEx
RemoveMenu
SetWindowsHookExW
UnhookWindowsHookEx
LoadMenuW
DeferWindowPos
GetDoubleClickTime
DestroyIcon
GetWindowDC
GetMessagePos
EndDialog
GetFocus
DialogBoxParamW
GetAsyncKeyState
IsMenu
GetMenuItemID
GetSubMenu
DeleteMenu
GetMenuStringW
GetMenuItemInfoW
ModifyMenuW
GetClassLongW
SetRect
AppendMenuW
CreatePopupMenu
GetMenuItemCount
GetClassInfoExW
SetPropW
GetDC
GetForegroundWindow
RegisterClassExW
GetWindowLongW
ReleaseDC
InsertMenuW
DestroyMenu
GetWindowThreadProcessId
DefWindowProcW
GetPropW
EnableWindow
IsWindowVisible
CreateWindowExW
SetWindowPos
GetActiveWindow
ShowWindow
RedrawWindow
SetWindowLongW
SetWindowRgn

gdi32

CreateRectRgn
OffsetRgn
CreateCompatibleBitmap
CombineRgn
CreateRectRgnIndirect
PtInRegion
SetRectRgn
SelectClipRgn
CreateBitmap
SetViewportOrgEx
PatBlt
CreateSolidBrush
CreatePen
FillPath
PolyBezierTo
EndPath
ExtCreateRegion
PolyDraw
GetRegionData
CreateFontIndirectW
SetTextColor
WidenPath
CreatePatternBrush
GetViewportOrgEx
GetWindowOrgEx
GetPath
MoveToEx
BeginPath
CreateICW
GetPixel
SetDIBits
ExtTextOutW
SetBkColor
GetCurrentObject
RestoreDC
SetROP2
SaveDC
IntersectClipRect
SetWindowOrgEx
Rectangle
GetClipBox
SetBkMode
CreateDIBSection
BitBlt
GetDeviceCaps
GetDIBits
CreateDCW
RealizePalette
SelectPalette
GetObjectW
GetStockObject
DeleteDC
SelectObject
CreateCompatibleDC
LineTo
DeleteObject

advapi32

RegSetValueExW
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExW
RegEnumKeyExW
RegCreateKeyExW
RegCloseKey

shell32

ShellExecuteW

ole32

CoCreateGuid
CoFreeUnusedLibraries
StringFromGUID2
CoInitialize
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
CLSIDFromString
CreateStreamOnHGlobal
OleUninitialize
OleInitialize

oleaut32

SafeArrayGetUBound
VariantClear
VarBstrCmp
VarUI4FromStr
SysAllocStringLen
VariantCopy
SysStringByteLen
VarBstrCat
SysAllocStringByteLen
SysStringLen
SafeArrayPutElement
SafeArrayGetElement
SafeArrayRedim
SafeArrayCreate
SafeArrayDestroy
SafeArrayGetLBound
SysAllocString
OleTranslateColor
LoadRegTypeLi
SysFreeString
VariantChangeType
VariantInit
LoadTypeLi

msvcp120

?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Syserror_map@std@@YAPEBDH@Z
?_Orphan_all@_Container_base12@std@@QEAAXXZ
??0_Container_base12@std@@QEAA@XZ
?_Swap_all@_Container_base12@std@@QEAAXAEAU12@@Z
?_Winerror_map@std@@YAPEBDH@Z

msvcr120

_malloc_crt
_amsg_exit
__CppXcptFilter
__crtCapturePreviousContext
__crtCaptureCurrentContext
__crtTerminateProcess
__crtUnhandledException
__crt_debugger_hook
__CxxFrameHandler3
_onexit
__C_specific_handler
__dllonexit
_calloc_crt
_unlock
_lock
atof
?terminate@@YAXXZ
sprintf_s
strchr
toupper
_wcstoui64
wcstoul
wcschr
_snwprintf_s
atoi
_waccess
vswprintf_s
strstr
_wtoi
_wcsicmp
strncpy_s
fclose
wcscpy_s
fseek
_initterm
wcscat_s
ftell
fwrite
fread
swprintf_s
_wfopen_s
wcsstr
wcsncpy_s
_resetstkoflw
malloc
memcpy_s
_recalloc
calloc
??_V@YAXPEAX@Z
free
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
_purecall
_beginthreadex
memmove
memcpy
_initterm_e
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__clean_type_info_names_internal
memset
_CxxThrowException
__RTDynamicCast
ceilf
floorf
memcmp

comctl32

ImageList_Destroy
ImageList_GetImageInfo
ImageList_GetImageCount
ImageList_LoadImageW
_TrackMouseEvent
ImageList_GetIcon

msimg32

AlphaBlend

gdiplus

GdipFillRectangleI
GdipCloneImage
GdipGetImageWidth
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipCreateFromHDC
GdipDrawImageRectI
GdipCreateBitmapFromHBITMAP
GdipCreateLineBrushFromRectWithAngleI
GdipSetStringFormatFlags
GdipGetStringFormatFlags
GdipMeasureString
GdipSetStringFormatLineAlign
GdipSetTextRenderingHint
GdipDeleteFont
GdipSetStringFormatAlign
GdipSetSmoothingMode
GdipBitmapUnlockBits
GdipDrawString
GdipCreateFontFromLogfontW
GdipSetCompositingQuality
GdipSetInterpolationMode
GdipBitmapLockBits
GdipSetStringFormatHotkeyPrefix
GdipCreateStringFormat
GdipSetStringFormatTrimming
GdipDeleteStringFormat
GdipDrawImageI
GdipDeletePen
GdipCreatePen1
GdipDrawRectangleI
GdipFillPolygon
GdipDrawPolygon
GdipCreateHICONFromBitmap
GdipCreateTexture
GdipFillPieI
GdipCloneBitmapAreaI
GdipSetCompositingMode
GdipDisposeImage
GdipAlloc
GdipCreateSolidFill
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipCreateBitmapFromScan0
GdipDrawImageRectRectI
GdipGetImageHeight
GdipCloneBrush
GdipFree
GdipDeleteBrush
GdipCreateHBITMAPFromBitmap

rpcrt4

UuidFromStringW

Exports

Exports

CloseSkin
FreeSkinFileBytes
GetSkinFileBytes
OpenSkin

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 470KB - Virtual size: 470KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 87KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

51dcb9e351489e3c75db9c583e4f741e

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

06:ea:0d:de:d5:5e:c1:e1:a2:9f:c5:fb:5d:ab:4f:b2Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

05:aa:43:30:0d:17:67:ac:12:49:43:54:21:65:bb:9eCertificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

65:08:aa:36:91:40:46:7d:8c:6a:e1:41:32:75:59:fa:fa:3a:c2:5d:a5:a8:1e:78:a6:2c:45:35:51:db:fc:5bSigner

c7:04:68:8e:2d:af:32:1f:11:84:11:7d:e5:cc:9c:a9:c5:9a:b2:47Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

msvcp120

msvcr120

comctl32

msimg32

gdiplus

rpcrt4

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 470KB - Virtual size: 470KB

.data Size: 87KB - Virtual size: 100KB

.pdata Size: 69KB - Virtual size: 68KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 32KB - Virtual size: 32KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

06:ea:0d:de:d5:5e:c1:e1:a2:9f:c5:fb:5d:ab:4f:b2
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

05:aa:43:30:0d:17:67:ac:12:49:43:54:21:65:bb:9e
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

65:08:aa:36:91:40:46:7d:8c:6a:e1:41:32:75:59:fa:fa:3a:c2:5d:a5:a8:1e:78:a6:2c:45:35:51:db:fc:5b
Signer

c7:04:68:8e:2d:af:32:1f:11:84:11:7d:e5:cc:9c:a9:c5:9a:b2:47
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 470KB - Virtual size: 470KB

.data
Size: 87KB - Virtual size: 100KB

.pdata
Size: 69KB - Virtual size: 68KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 32KB - Virtual size: 32KB