NEAS[.]cd46ab98a6c7ff8b0ff4135a848a3200[.]exe | Triage

Sharing

General

Target

NEAS.cd46ab98a6c7ff8b0ff4135a848a3200.exe
Size

708KB
MD5

cd46ab98a6c7ff8b0ff4135a848a3200
SHA1

8bcb28276486de84442382b442ee31eb5b698416
SHA256

de42d3b827610dd1f05e1d3919b13a3c2d080edcdc8a9863ddbaee74a793f434
SHA512

fd06b52f1036974204086756fd3211229ac59e389fb74dc45cab20cd781a9d3a17ae7e88389ea6cf0ad5329ad5364f2c919dfa5697d7c35ea266ac8d06a61295
SSDEEP

12288:A27ZxYRx8fgBDtH5PlWTCL28rFQvE5yj/+DJbsQQRhQT:zYRx8aDtZPomLTS85S/+DJbsQQRGT

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.cd46ab98a6c7ff8b0ff4135a848a3200.exe

Files

NEAS.cd46ab98a6c7ff8b0ff4135a848a3200.exe
.exe windows:4 windows x86

500670908c8b2eb548b380523b4b29fd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaVarSub

kernel32

LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

MessageBoxA

Sections

.text
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 536KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 696KB - Virtual size: 693KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ