NEAS[.]f5e7a3d42f3a136c3f468ff86345cfb0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.f5e7a3d42f3a136c3f468ff86345cfb0.exe
Size

668KB
MD5

f5e7a3d42f3a136c3f468ff86345cfb0
SHA1

ba03f02f1ea6cf0660197feae25c02badec62640
SHA256

0a2e2545b2f097b497ea3433d36211b8b23b28ed354d60f266b18ece264339c1
SHA512

21d2683ce2c5958368ca1b87a03bdcb34fc30d4709ce06bbcbdcc4470400c802e558051d6ed728a044457c94f3f2678310574a00567f0846e689376bfcc190ac
SSDEEP

12288:QcaZDPfr7ISsUIDnfnnEFze8Skw3Q7K9HbgurSAUKm3N:QROd7nnE9eXkw3QubgExUKm3N

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.f5e7a3d42f3a136c3f468ff86345cfb0.exe

Files

NEAS.f5e7a3d42f3a136c3f468ff86345cfb0.exe
.exe windows:4 windows x86

429cfc2700e0bd43f1d53534858c3bce

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvfw32

DrawDibDraw

avifil32

AVIStreamInfoA

rasapi32

RasGetConnectStatusA

kernel32

FreeEnvironmentStringsA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

MapDialogRect
MessageBoxA

gdi32

SaveDC

winmm

midiStreamStop

winspool.drv

DocumentPropertiesA

comdlg32

GetOpenFileNameA

advapi32

RegCreateKeyExA

shell32

Shell_NotifyIconA

ole32

CoTaskMemFree

oleaut32

VariantCopy

comctl32

ImageList_GetImageInfo

oledlg

ord8

ws2_32

inet_ntoa

wininet

InternetCloseHandle

Sections

.text
Size: - Virtual size: 566KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 295KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 196KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 652KB - Virtual size: 649KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

429cfc2700e0bd43f1d53534858c3bce

Headers

File Characteristics

Imports

msvfw32

avifil32

rasapi32

kernel32

user32

gdi32

winmm

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

comctl32

oledlg

ws2_32

wininet

Sections

.text Size: - Virtual size: 566KB

.rdata Size: - Virtual size: 572KB

.data Size: - Virtual size: 295KB

.rsrc Size: 8KB - Virtual size: 28KB

.vmp0 Size: - Virtual size: 196KB

.vmp1 Size: 652KB - Virtual size: 649KB

.reloc Size: 4KB - Virtual size: 136B

.text
Size: - Virtual size: 566KB

.rdata
Size: - Virtual size: 572KB

.data
Size: - Virtual size: 295KB

.rsrc
Size: 8KB - Virtual size: 28KB

.vmp0
Size: - Virtual size: 196KB

.vmp1
Size: 652KB - Virtual size: 649KB

.reloc
Size: 4KB - Virtual size: 136B