��w+��b���h8���f�1(�վ��C��=±E��1��ޒM�0�9e��%]}5~9�,�KT&E����d^��Γ��䰪M��ă�f;dW����W�1!��z�ty��u�v���c��� ��&4<��^D�"co�RH���jZg,|f{ެv����d+��쐈��8��K�K��#:�"(�7�G�D�FV2o_�����Mq� �'MZ ��� �1\��܇�RM��a0��aw�Q����s�����`�.F��t��#-����5�C��`Q~�>�-x����F0f[��۫�O˴s�О�-"��!�������e�"Q�=��������4��7w���,+�[�p���, t�[ewiH�^�34�6>�mf��g�|[%(�!�>J���J��<��p�����%覮��)����*��3Z-�d�n��:��6�JE����5B�o���`�t� ?�R�� ��E8n���;�=Ԑɝ��s�z2��q���6|X��>Ռo��Z�Pq����&�Rc��ц�P. ;N��.&k2J`�=��F� XQv��v�ˌZ^wcOh�4�9���oo�������:E~M�5ML�[z]�o�||���D��V~���W�Iǩ%������1�O����~��m�#:ޭP�l���� 5�h��`a��-|S;RX:'b��-�'�O����iLS� �� D�6�e�s�o�~.��ټ���@� �K��oƓ{,����/���ԪN-�rXI$y�{'�����Ό��"��>����.uS �Q�[�N�����U��bCF���fC4�!�X3�wT���9K`kaj ��������1�+�i��juQ�@6ږ\���Wc�6���R6���Eج��Y�����2���m%b(�c��N�R����ٗ��V����ˍ�!>����O��B�6729˙fO'L����.z�x���i�{����0" �Ь�e�&�+!�����P/B�j�nӰ $��t3�cQ��T��0���������P�N��.a���e��VD����G�i����r��#�H`*ї��f�����|S����")�Q���am��7T�_D� �����IW�y_?�e�� Jí,ek�l8iz�F�݆�i��0� :���$�H���t�w��(�Չ@��kp9�V�}G9]���_4Z���l�V w��ܠ!�#�~��9������ԓ0*=����"�NK�@� �PGk��9�[�{�~r��v�2�^�*�I!oe���.TEL����b[�Du ����'�8�}a�!�3'Ya4L�L).M�C����if�n٢~��_)&DQH�e#��*�)(����d�ixχ�5�a��رIJ��M�� �N��������g)Y�����?ms��ʵP�SO�ߣ��6�S'O�(�tK��� �_��n������nQ=�*�zZ6�a:;�yH}�m'�5\�XRw�/zIk�?�2��yX5����H� (�t}Pf�z �oZxm̺g~�) �f�,�7�o�P/�7�� qK�ɾm��C<ۿsGN)27kơ�6����F��]�U����O�k��:E��{�:J��`ZNϛO%6���J�����5��=��/4w�:.�� ���r#Z������G��:U��P6�a��l��� �� �|Y�� `s)�[�ڑ9��dB �t�杰�njg��X����ܴ�ںCv��I�N#Hr*��@�j���ɫ�儋��C��MK������q��@Ԃ�gZો�deY%ٍ'ހ�d� �H���b��jm�d�7rhu�e����,ٺXUR����]�s�s�0>s�\x�-���=~]8���q�2�Y���2�E'�/����%JW�ϥMՄ�rd'�Mb��t�)NJs��DPf�0� �0B�^Wz���[��)�4� v����td?)�r��s!A��z�'�&yv��6�k!&���PK(YY��Ј�~��%+���r?G��`�$���S����m�c�8GB��:'I���ZcBqM��-���꣠��@dL�˒<�R��Z���9������4r�=�y�'�v�q��Z����Vy����s������s������X$���L*Q�;��m�"�t����e�(Y�����L�^c���O���LV�+��� �K+(�m�d�)k����d����^(MJ���U���)I���ͺ��uK^vc���>��ª���2��H$�\M�c�O.�:��|�G� Z�B��1��������dO���Ҩ�#g��>�J���(�����k��?��x;"������[��[��@���2�D��J���4��-���o�����0��*;� ,I�o���n��r�V&e���������l���5�$���{�Y���Z�-��b��K˦�J���dH���ǂ� �1��r�tM��Ԫ0���ezw��9��#k�U� 䔱z>��Oj��'�'vP����_����à��!���.\��n�,���4�}�bʛp+�����,�s�3�/��f�B�K)P;���=4;���'�|�N,�VD�HL�s0��%�n%d~@�M4�k��՜�#�6y�ͬ:� �u���@�#8#ċ4WEb+^I���� ��r'ߣ�o���|1Z;4!�o muԝ�`�G�U�2L�ex-1�e"�(k���^�b���T2�-{�L.��7����pM����-��eB������m�O@̃W�~ e�JY9%���e�?:<��/��\ѐ�=����2H�Q�2[����K'�x�����ԏ�����0!+��P��5}�4M�:�a��6R�{Q�cC��n8�5��K'=�D�w������%ׁ!�g$����|���c���{Hx���gwW�o7Կq-���}������oQkj����q���;D3 ��DT�[o���w��C.�{���^���r*��G5M � mjG���(��]((��$t �Υ��P��9h���7#@�����K�va��0�5�����iT��ϡPg1�S��t���� VF��;YhwJ�z�rh��
Behavioral task
behavioral1
Sample
NEAS.b3a8cf6ecaa9a39cd9fdfc30c69b3e20.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.b3a8cf6ecaa9a39cd9fdfc30c69b3e20.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.b3a8cf6ecaa9a39cd9fdfc30c69b3e20.exe
-
Size
7.3MB
-
MD5
b3a8cf6ecaa9a39cd9fdfc30c69b3e20
-
SHA1
9c1d8eb1033bb0f657166b64edbed344c3b03ecb
-
SHA256
f279fe7c3ad51d138089425b1975dc1c3bb85feb065d8aff222a10ed22ea1a94
-
SHA512
f6c6fd7154beec4cb0e80ecc5304970bf94ad23765becd6fa73009eb01b01c414975aeec67f6b55e3998706c1d346f48474f12341c7f67d9b9ca4b558262fbef
-
SSDEEP
196608:2Cq4JSG/BONr01zFy0zw+1+wasL2KGTiR4DYeU:ZONr0F/zVoBq2KiZDY
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.b3a8cf6ecaa9a39cd9fdfc30c69b3e20.exe
Files
-
NEAS.b3a8cf6ecaa9a39cd9fdfc30c69b3e20.exe.exe windows:5 windows x86
765b12ecb9d0e84be301ec738d3ba22e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IsChild
gdi32
CreateDIBitmap
msimg32
TransparentBlt
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
advapi32
RegDeleteValueA
shell32
SHAppBarMessage
comctl32
ImageList_GetIconSize
shlwapi
PathIsUNCA
oledlg
ord8
ole32
CLSIDFromString
oleaut32
SysStringLen
gdiplus
GdipFree
wsock32
WSACleanup
wininet
InternetReadFile
imm32
ImmReleaseContext
winmm
PlaySoundA
Exports
Exports
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 276KB - Virtual size: 275KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 79KB - Virtual size: 78KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp0 Size: 146KB - Virtual size: 145KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp3 Size: 153KB - Virtual size: 153KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 124KB - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ