InsertSvc
ServiceMain
UninstallSvc
Behavioral task
behavioral1
Sample
NEAS.1b2d12c74779549853d45fc8f60734a0.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.1b2d12c74779549853d45fc8f60734a0.dll
Resource
win10v2004-20231020-en
Target
NEAS.1b2d12c74779549853d45fc8f60734a0.exe
Size
200KB
MD5
1b2d12c74779549853d45fc8f60734a0
SHA1
5e11098808a21a0803e7419d949cb934a2e83fe4
SHA256
94b471254ff6c64c0466d982274a0c1f92fcb47599901c641da2dde17db3cf67
SHA512
03d4e3166a43be762b77c85ab476baeee385959c35002d39fcf3420a42adb55eb3fe2946347528b37237da8ca5e22827e6bb6a44c65c691f19ec3681f4996244
SSDEEP
6144:DZeJf6QmzLekbRFkAlJFxf/73QQnGRPfIWNRWxh:DUJSLLrCc0QGdfIWNg
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
NEAS.1b2d12c74779549853d45fc8f60734a0.exe |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetConsoleCP
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
DeleteService
InternetOpenUrlA
inet_addr
URLDownloadToFileA
FwpmEngineOpen0
GetTcpTable2
WTSQueryUserToken
DestroyEnvironmentBlock
InsertSvc
ServiceMain
UninstallSvc
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ