InsertSvc
ServiceMain
UninstallSvc
Behavioral task
behavioral1
Sample
NEAS.11e2fe0642d3612e788e148bd4d62f40_JC.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.11e2fe0642d3612e788e148bd4d62f40_JC.dll
Resource
win10v2004-20231020-en
Target
NEAS.11e2fe0642d3612e788e148bd4d62f40_JC.exe
Size
197KB
MD5
11e2fe0642d3612e788e148bd4d62f40
SHA1
899bc109efb8ea8b24be78bf921cd3327a0fda07
SHA256
4a0886726953c3d5191ff9c01879f96a3b0031588fb41d9a1db19704524c33be
SHA512
01ba2cf03c42c75598bbf3916bf2c9343746488bebba23cf909cc0717b312f5b3340342bb6a8caf717b0e8629a1c7304b8ed4bdfca4227da0df85703f18035c1
SSDEEP
6144:eufWR4SdplnIU4ulyYSQDfamIMmayPRBgQ4+k7pNSO:tfWR40plXyhQDfTy4Q4bN
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
NEAS.11e2fe0642d3612e788e148bd4d62f40_JC.exe |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IsValidCodePage
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
RegisterServiceCtrlHandlerW
InternetOpenW
ntohl
URLDownloadToFileA
FwpmEngineClose0
GetTcpTable2
WTSQueryUserToken
CreateEnvironmentBlock
InsertSvc
ServiceMain
UninstallSvc
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ