��:!�+���0�$N������"�ۚ^�qg/t`E7J lp�����Y6��gQ�0�(=���O��l�j�U�2�|*U?YqԞ0���5����6������Q#��qE tÄO����c�ď� ��&b�_���H/ұN}��q��Nv]2���X��<s����������Bc�1KL�~�B�N��.��OA�������L��������t��}o�m�����c?l�;��j��Jǔ���r"_8~�(. G?F�d�j�{N���9���4 �$./x�{z�45.�,�E�Ь�Z��]��Nԩ���+\��>��N�o��ڬ���t�U�o ���t�,�'����1��%�/�C+�M���ѹd_uC�3�[����՟�Q��Nw�a0pp���k�v�`�P�)�&<jO�p���^���𨐮3��� �_�J�8TP�W�5h!@�5�ֺ=!��T�������C�Q�����İ�s���?��gO�iO�ٵ��#O��n�� :%�v�8����=V)�^��� O����G���o���'�)�_�,:_��+���L�U�M&!�M��D(�(8���k1YIqF?\�!�o��zS������]��2��,躆+E���s@YjU�*9t�Wy�2���w��_2? ��!N�sq���(�湠��ڝO$Ҳ�'��]����1Ó�@N�Ѥ�N|0:2(L���Pd�!��~�r�4���#��(&�7� H�T�#<�T�ha���?|t_��m������]ۂ�t�z7��eq5���:R��_ D�Z�O/6֮3>i0^���]��=� 0su�����l +e����;��6��\t����l������x�s�UZ��@fɑ �x��j}'�vxy �M��F&���b��!��E$9�{e���� Ѣ���IH#j�{��0�ڵ^ ��� �����ǜ��D��`��g}�3�̎�i����&^� ����e���ޣ��Hxb�=rRl{�ӳ��O�gm;w�ٽ�y���}�S.5z�ۅ"��5t��?I �5�����m��+"�;D���8es<'-��W�go~�ӛ�w�MM��҆�us�i���1�nf�\����VࣹV���,�4�,���Ϳ���9�F��ر��r9�&M=�)?��~���{�89��T&�k ���=b =���WKc�6.~��{Bn���z ���1�Oڌ��P��R ��ൠL��\i�on� � �/���,����{������6��rx`]qHWƅ/�{��V>�iQ�5�r� �����9ɞ#6��k�zI�f��1<��&�&Kr���7�����˨���<���B�'��1@E��� o�����u+���}�o"��G#g�,z�����$Kz�����Z�J�0���ٵH�_�GcσXK`m�0a��T�X�$]�#�ԭ�B�{��.ߕ5������:���Gn������{�Y����QT��Fzg� 7�)s�n����b����~C�Ut�J�`ʊK���*��Fq �B���7:Q�j�*��Ӛ�����q��֘9�H�=�6 � ю�]m���/!h�e����2���:�o|�m�N��w�6��Cd7��������OI�'��6��*f �Ă�I`��`y�C��5��y�S]?�`1���Fhb�3��HLN�a\������~�wHJ�.~�;������1�3� �ɥ���B�����.�pIw�!�2M��F8�|�:xa�mj���i�OP����Hh���v�:Ab4����$O�)?J���y�!�k�i�����Rb�fF�Z���)�q�D�B%\�"WƯ������A���Z�pS��>^S�/� ���D3 ���Cu>*u��O �iGﺸ3�z\E 'TT|=�3�A{�Ki?��!�(����I��9m �������痗�Q��R��C��|F۪dӗ�m'�s���|ɜ�4�f���Znm����H9�$p����"�����T<�l��ww3(�E2O<�tW��ԥ.'o���6���:^�5D���% ������qw���$�o�/v����p�S �������>;���� �ʳh���G�CMq�;O>;��͍�������?"� �a�ݝ5�%ƑE��D�K�9��F2��y��R!W=A�L c��d����c��r���2ؚ_����)Zk�~d'�`p��E(�u3�d���u��m�scBvhxm2K�;�tP �0W�Oa& ��J.t���ԉ)�??Ĥ�*\aU��&�z����]����6���/+S`/[`NR�Ih���$9'��U�X���2��d��`ه^7G�8�w�J���i��E:�/8T�O+q�q�?8�0����q)�~�>mR���F1���;-��%�e�q�_��\��rkTփ�%Ag�S{�?1�,���wd�=A�����=5k����\L%dޡ�_��$�mZ��DeL�O)��W�of����rF1�8��H�[VD�7U �*����;��H�KA���h��6�*�!� �p�P�� � 9;k,�},�y�;���V�4���&�ɘo��K�g7��:O�1�`��f/ȟ|֤�jT�Å���f�E�`KDf�w# �T�?���ו��O�����%��U�����{.ค�y��c~����-��fh�曷#�aq]g�Ќ��V��0�8�$� ��(���n�E����p�W� �J���U���ݐݰ��C� �A�<^$u�3y���>B<x��$����8uW�~}�����zL�YQ���S��������'���m|��mF�uB� �h��rCw�1.@�",`;�f�HY2�)�-�K@"s>���P����Ӝ��� N]Y�\�{թ�sQC��6%�KU���0s��j�U���Z~�ߕ�oB�����Gm��-G2'�4ت������Ҽ]hc�Z`1��LJA5K=6bU^��ڟ�ԍ�j��_��md��c��z�2z�}g��F�(�������A�f���?�46-9I�����:�����y��U
Behavioral task
behavioral1
Sample
NEAS.f2d39891ab4ef5fe922233850237ad60.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.f2d39891ab4ef5fe922233850237ad60.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.f2d39891ab4ef5fe922233850237ad60.exe
-
Size
4.6MB
-
MD5
f2d39891ab4ef5fe922233850237ad60
-
SHA1
e0c5b0e512d155938f42e71a3baa2168bcee7d6a
-
SHA256
dd7465308ab6bc5f49ec80210ff8fa9e1edb3587b30a10aa018118bbbd6e4708
-
SHA512
65e3f0ee1288488c82a68ad912b754da73626a56c395f35f873c8276e8887af95f94a2705b89d7350499b3d0b30111c685884f7011269708d69a09d21fb94fb4
-
SSDEEP
98304:239r7TCV5khEhsItLTGLKjL1ZxxVr00NThXOVo8:O9rv6MWrLTGLKNndNThXN8
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.f2d39891ab4ef5fe922233850237ad60.exe
Files
-
NEAS.f2d39891ab4ef5fe922233850237ad60.exe.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: - Virtual size: 754KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 419KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 8KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 562KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 4.6MB - Virtual size: 4.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ