NEAS[.]e890f46bb2af3436c9b9455209c09f53e63f1c0246913b085f02af717fe42290_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.e890f46bb2af3436c9b9455209c09f53e63f1c0246913b085f02af717fe42290_JC.exe
Size

9.3MB
MD5

60869934ac60f3e29559b372a725ecfe
SHA1

17c3eccf8417f0613f6f3edf90cf15dc23f1be6e
SHA256

5bd3fc9e738a49d833e4cd3820fb2a116f7310dd236293dee2308ac8a7f466cc
SHA512

8b0b0103476e793bcb44c799f1b1a5bd1cf381d6d92fb092a86d3fdeb25b1e33d6a309cd078ab18b3c1b6c468dac9a5bdc1478aaa8a11efee857ca99eece5470
SSDEEP

196608:Wn3ugZN635PYm/kkrIa89WwSyVcIgwr23pHzvyIGjBqbdlJk8:W3ugZN63NYgkOIa89HSyVcIO39ryBslb

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.e890f46bb2af3436c9b9455209c09f53e63f1c0246913b085f02af717fe42290_JC.exe

Files

NEAS.e890f46bb2af3436c9b9455209c09f53e63f1c0246913b085f02af717fe42290_JC.exe
.exe windows:5 windows x86

f7a69174976aef20c38a6354f2ad5e35

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

midiStreamStop

ws2_32

inet_ntoa

rasapi32

RasGetConnectStatusA

msvfw32

DrawDibDraw

avifil32

AVIStreamInfoA

kernel32

GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

SetWindowContextHelpId
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

gdi32

GetStretchBltMode

msimg32

GradientFill

winspool.drv

ClosePrinter

comdlg32

GetFileTitleA

advapi32

LookupPrivilegeValueA

shell32

ShellExecuteA

ole32

OleIsCurrentClipboard

oleaut32

SafeArrayGetLBound

comctl32

ImageList_Create

oledlg

ord8

wininet

InternetOpenA

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 5.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 627KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.link
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rloc
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 10.4MB - Virtual size: 10.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 268KB - Virtual size: 266KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f7a69174976aef20c38a6354f2ad5e35

Headers

File Characteristics

Imports

winmm

ws2_32

rasapi32

msvfw32

avifil32

kernel32

user32

gdi32

msimg32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

comctl32

oledlg

wininet

wtsapi32

Sections

.text Size: - Virtual size: 1.3MB

.rdata Size: - Virtual size: 5.0MB

.data Size: - Virtual size: 627KB

.link Size: - Virtual size: 1KB

.rloc Size: - Virtual size: 1KB

.vmp0 Size: - Virtual size: 3.8MB

.vmp1 Size: 10.4MB - Virtual size: 10.4MB

.rsrc Size: 268KB - Virtual size: 266KB

.text
Size: - Virtual size: 1.3MB

.rdata
Size: - Virtual size: 5.0MB

.data
Size: - Virtual size: 627KB

.link
Size: - Virtual size: 1KB

.rloc
Size: - Virtual size: 1KB

.vmp0
Size: - Virtual size: 3.8MB

.vmp1
Size: 10.4MB - Virtual size: 10.4MB

.rsrc
Size: 268KB - Virtual size: 266KB