NEAS[.]30e38fa999bd4dac67a60d2bf339d9e0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.30e38fa999bd4dac67a60d2bf339d9e0.exe
Size

3.1MB
MD5

30e38fa999bd4dac67a60d2bf339d9e0
SHA1

89d032fc37fe0968db6b04f5df6e358a2aad56fa
SHA256

572c74c62f62a31f8c81a08c38cfbdcefabdb163b210cddfecf83aec2f1f1888
SHA512

70f36d04a467c2f408d64698585395093f32e5555f0707fccc588b4a11e4766380ac0dba62813091384d4b7bb567d908428231000a0602d4a5accdfba402123c
SSDEEP

98304:xqA6NBJH7pVYZYEasFsQXmhDOvZKETtEe:kAQf7cSCsQXmhep6e

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.30e38fa999bd4dac67a60d2bf339d9e0.exe

Files

NEAS.30e38fa999bd4dac67a60d2bf339d9e0.exe
.exe windows:4 windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: 79B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 75B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 448B - Virtual size: 632B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.imports
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: - Virtual size: 5.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ