NEAS[.]cf235a42de5eb32a2ad78567b0c8e6c0[.]exe | Triage

Sharing

General

Target

NEAS.cf235a42de5eb32a2ad78567b0c8e6c0.exe
Size

472KB
MD5

cf235a42de5eb32a2ad78567b0c8e6c0
SHA1

cf7686e05b32eca6f6ae525575661603ef002420
SHA256

9918692816b85a0e9ca0f903287f2a9152df3a2f9c1c06412ac3b3fb47c5d623
SHA512

d1024124821146195459a41c513a4b933ffb1d1b0b0c5200434f71b141fe9cbcf4eb86550d2b25820abb87d5f95e15bc23f087e2ab93e22744e805f2fc69338f
SSDEEP

6144:nK4bhx3qSUOMuaDOE9Bd6RhLo6XFlkWGo4TlryAbl:Jtx6S3M/pT6rUGkWGoct

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.cf235a42de5eb32a2ad78567b0c8e6c0.exe

Files

NEAS.cf235a42de5eb32a2ad78567b0c8e6c0.exe
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: - Virtual size: 509KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 4KB - Virtual size: 24B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 452KB - Virtual size: 449KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ