NEAS[.]2d0a2133411bcaa920ba6f4aae8bc830[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.2d0a2133411bcaa920ba6f4aae8bc830.exe
Size

766KB
MD5

2d0a2133411bcaa920ba6f4aae8bc830
SHA1

5f044b64d0523e7fa9bcfa83b7be094c521cf929
SHA256

6e0f5a22072f90ef45a66e87dd93a90cb57ee2324259afd4646ffed512ee2efb
SHA512

da6430099e496e99cea15c0edfe2f0a18c3b615c09d26b8a7d0f6e1966b47b9f50f37404eba6023704ecde71c46bca8e4c5d37245a2629f7123b38a48212f24d
SSDEEP

12288:bPWV6k3y1qb2BsR8ZRjGHaz3MrBN5IjBomj3aVhsd4HdxscYlKioO4mc355eWTB:LJDuuZRjGH510jdj3LCHdZioyc3eWTB

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.2d0a2133411bcaa920ba6f4aae8bc830.exe

Files

NEAS.2d0a2133411bcaa920ba6f4aae8bc830.exe
.dll windows:4 windows x86

e4b3b3bc941eb945a9358714d46662fe

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetVersionExA
GetVersion
GetVersionExA
GetVersion
CreateThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

EndPaint

advapi32

RegOpenKeyExA

oleaut32

SysFreeString

version

GetFileVersionInfoSizeA

gdi32

RealizePalette

ole32

CreateStreamOnHGlobal

comctl32

ImageList_DragLeave

shell32

SHFileOperationA

wininet

DeleteUrlCacheEntry

urlmon

URLDownloadToFileW

wsock32

gethostbyname

ntdll

NtQueryObject

iphlpapi

GetExtendedTcpTable

oleacc

AccessibleObjectFromPoint

gdiplus

GdipCreateBitmapFromHICON

imagehlp

MapFileAndCheckSumA

atl

AtlAxWinInit

ws2_32

WSAIoctl

Sections

CODE
Size: - Virtual size: 782KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 14KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 759KB - Virtual size: 759KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e4b3b3bc941eb945a9358714d46662fe

Headers

File Characteristics

Imports

kernel32

user32

advapi32

oleaut32

version

gdi32

ole32

comctl32

shell32

wininet

urlmon

wsock32

ntdll

iphlpapi

oleacc

gdiplus

imagehlp

atl

ws2_32

Sections

CODE Size: - Virtual size: 782KB

DATA Size: - Virtual size: 82KB

BSS Size: - Virtual size: 14KB

.idata Size: - Virtual size: 13KB

.vmp0 Size: - Virtual size: 98KB

.vmp1 Size: 759KB - Virtual size: 759KB

.reloc Size: 512B - Virtual size: 256B

.rsrc Size: 5KB - Virtual size: 31KB

CODE
Size: - Virtual size: 782KB

DATA
Size: - Virtual size: 82KB

BSS
Size: - Virtual size: 14KB

.idata
Size: - Virtual size: 13KB

.vmp0
Size: - Virtual size: 98KB

.vmp1
Size: 759KB - Virtual size: 759KB

.reloc
Size: 512B - Virtual size: 256B

.rsrc
Size: 5KB - Virtual size: 31KB