Behavioral task
behavioral1
Sample
NEAS.ed80386632967eb177c4adc709b74760_JC.exe
Resource
win7-20231020-en
General
-
Target
NEAS.ed80386632967eb177c4adc709b74760_JC.exe
-
Size
4.4MB
-
MD5
ed80386632967eb177c4adc709b74760
-
SHA1
2add228aa59836c75a619455fc92ca48a07c3788
-
SHA256
31b653d5da85b7c27147efe85f1e82b182bd70714b698d6d9de4ba0418f719a7
-
SHA512
ddb3854dbf29afc715462650bfebc23ca08cfa972930827ba7cbeb536364c7cd044d38289ba85b4a094c5d77a61fee5529a4cce15199fa82fe3f56a71bb51fc4
-
SSDEEP
98304:Mh54KYYgvkI13fZVrWzaaTMObQ8/MU93Dir7:1TL13fPWzzIOnpir
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.ed80386632967eb177c4adc709b74760_JC.exe
Files
-
NEAS.ed80386632967eb177c4adc709b74760_JC.exe.exe windows:5 windows x86
77decb53e911d39d12a3d2758b2adfd9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
GetVersion
GetVersionExA
GetTimeFormatA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ShowWindow
gdi32
CreateCompatibleBitmap
comdlg32
GetSaveFileNameA
wsock32
setsockopt
wininet
InternetSetOptionA
shell32
ShellExecuteA
ole32
CLSIDFromString
dbghelp
MakeSureDirectoryPathExists
winhttp
WinHttpTimeFromSystemTime
shlwapi
PathIsDirectoryA
oleaut32
SafeArrayGetLBound
version
VerQueryValueA
advapi32
AdjustTokenPrivileges
gdiplus
GdipCreatePen1
psapi
GetModuleFileNameExA
ws2_32
WSAEnumNetworkEvents
oledlg
ord8
rasapi32
RasGetConnectStatusA
winspool.drv
ClosePrinter
comctl32
ImageList_Duplicate
winmm
waveOutOpen
Sections
.text Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 916KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 885KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ