NEAS[.]699565d89b1ae5c9f2b480253e7d1f90[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.699565d89b1ae5c9f2b480253e7d1f90.exe
Size

3.5MB
MD5

699565d89b1ae5c9f2b480253e7d1f90
SHA1

c3cfb9477c92458f957e0e918b7b4ed9ec8ddb41
SHA256

34d68eaa66674320ac315d4fcda67d1acb2c548f2d41c160203f24f85f4e02ff
SHA512

9afc58bd342ce919882933a499e4c129715c387cdfdaf3c410b03b815561dd8283b204539196c5a77932ad837c7d06a83ed62c0a2cd19cf4f8ed92131afb384a
SSDEEP

98304:Zlzi6MTpN1qzX4U3RBIH9hO0oD/MQz0Nb7Tr:TjeN1qc0BIHPO/D/1z0BHr

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.699565d89b1ae5c9f2b480253e7d1f90.exe

Files

NEAS.699565d89b1ae5c9f2b480253e7d1f90.exe
.exe windows:4 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: 106KB - Virtual size: 312KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 24KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 5.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ