�}0�U:��Y�\hB>�h��AKV���97��c�����U�X� ��O�TT_ r%_r$Of���� ?�])�=B(�����%�6rS\W�������ˆ��3NnTi�<������8WN',@r��z���z�7EA�&����)��+�tt]E��I��[e*E������e/5b��CN '�K���M�(b2u��h,� /�i�h���G.J�GO�(pN'D��Y�ȑ� $*�O�S%���rwG�2Z�$�nP����>�ֈ������M[����3���ӽV�{�=)��%?��K\�+���a�"�T�0��x��=�D��!9M���:�,����{�{�)"%�p?Vvl�����r���"%S�/]6+o¿��� ~�BZ���1�.�vH!��'���+飵�̸�8u@��p��j>� m�~#4�31��YYy�/�i.��\6��/hو{OI�����LQ�E/��g`ukY��p-(�^�y��r�T�_��;t�>��:��ty��0���}D8d��I����QR��x�7@�? #Z(�.�%�5�HQCx��}/����P�a��WzDd�t;ep6,�C�ʥS��3 е��g������7^��Ј"����]$�G$N(zY�)ño +Zj�@�^�'�./��1�L�G��f�L�ޞ-�T>.4��xH����P�1V��(L��s_V�j��a����1.q�|k1�-�K�j>{x:9l�"O�g����m{Z�WK��(��T� _TUjy���e ������r6�t>9�H6{��4���.j+3�H��>���h�Q.��!�CJ~��E,bc��w��$ݹ��%M�r��D��4G-�����I�l�mb�OM�]��@:��e�.4'u0����U��p �H%��W[�hƿ��Ԟ�+���xP@�JsS9���]O-�7a+������RHqE|P��*5$�d~��;;���r.S����+�i��l��Z��q�"�yr��������Og�⸮o�|������#͘� N9V���YY���`��Y�ث�B2_�W6)���7 �y�>��#��Tՙ��A�� Z�����7�~�=��+�%����eS�k��[���q��@�yG\���\�Kz�h��V���Dk��������gJ��40��`/@�$gab��;8�,Xh��Ȯ9�D�Z�&�6C�����fb����V��]�w��m�2t]�f�����1 4d���hOɣb�c����d^�o����m:���H����>�gQ�/���ȗL����4 XD$ڄ��گ�� �H� !1^�#���@Պ�_��f�|x�����r�� ��8� ��+ټ�p�N�m�-.w�Lz����?����O!,n4]y�� �Cp��a�v`�����s��(��������_{bO;�~:���Ѡ��jBX�k���G��� ���>����8:���Hj�:r���I�t'TPM��+�y�^K�X����� �� �u[���-P&���d���UMSђ'kݽ����.�6�c� �B�ڿ��{��9����F�웶k�d��ic��e�{ae�� G�R���"k�U!�b��.p�u��/��?��o"�`��K��v|�W��䙣>$4DB���2�u�4�(��ǂ �K�[g�I>z��Z��=����c1���2���L84��/":E���BZ@2[@�5�v����!��z�ξj*�Q�K-�;_�,NO����_�̇f�m)!�)�^`[|qJ!�����%٥��xJ�J7�l}4���Q��ҡ��9H�L��B �X��fv���^z�3��4&�+��nY�/���WpG�,�����B��X�j sZ��G��Gg�|�ؘ�l�ύ�i i�:� �w�O+L����Nb$"$���� �����(��Y�a��|S5���ɼ�6'���/vn������N���#�i2^�6�3Z�V�^���@���N�C�R�p����� #�k��A�a�㙸�fף��ͧt���V�|fW��<FV��(\���R�J�����c�*@�y�weYgBw,��TUb�0h�P� ����V�J"5���Jay�q2U|*9�8�I:�]e�/%���f^bv�iLu��)jK�E�{�-�_�������f�j`�T��]����#��F+<s*��f��~��X�߉���nx��U�n�l���2� > 2Q�X��/9ÕMjXdB6Q;l+b%�-N���f[�/D2g�� M@[�@pxJ�n������&�]蓮�V�8 #H� X���o~�< u��R��ׇ��D��~�߇|��w|R �Y���O�!$y�͑H��~�)H0+�fn�?���n�s�鸭������M�b��r�E� .1�q��D> P�暯d5���H���)����������JF@��y��ݡD@�_*�N_��g´�3��`۱K��t���x��.���qF9�Y$���P��ʟ?��'�YÐ���S)��y&e�%�ʽ;��O�� ��h����X�� ��H3�O䊚�O�uu|���H����r^]�&\;;��=J�`(�ŵ���"�⍅ۼ(�ИY^俰�G6%�o��ӶP3�XGSj�H��i�ޠ�i[�Y6Aބ����s�A�'���V^�=���OH�i��G���p!}��9��K���3��/�Xs{-��J���!{.�XT�T�w��/J��>�%���߷��~��G|u�F#��Z�����kjv���3720��������f��hF�;+j��z�V�zϞf�z��q���ÁR= �*��Ǔ��z��M�y`����`�*�1���X�-������H���h�3�Bj�����?�����Ԝ6X�9�]^p2�qv��Q��ׂ��i��}�2���Ui�H�����@���j�r��l6A�:������!�?�N��#S%g�����vHur�n |��-�Ro��:u�E�א�*�d��|��B� T%S庝��6�,$��.�O��`tT&u�=��`�P�M��6!�:w�a
Behavioral task
behavioral1
Sample
NEAS.2fc07439452f83ec562e3bc04dddf320.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.2fc07439452f83ec562e3bc04dddf320.dll
Resource
win10v2004-20231020-en
General
-
Target
NEAS.2fc07439452f83ec562e3bc04dddf320.exe
-
Size
434KB
-
MD5
2fc07439452f83ec562e3bc04dddf320
-
SHA1
f0349bd9f145265aa085b8af570730511ed54438
-
SHA256
8323f52e5a3f93b95afec4065e7298ec134b39c41f7c40a90e2a47935ec1e4ed
-
SHA512
b00e46a3dcb875a00e5a22615ee39aa4bd5d3febe504f002dfa9ee2cd28cce6199f7d174ce93683fc61b814943a7896f9cc49ed2b9550fc60d94df9aebbb3e6d
-
SSDEEP
12288:KUJufEuyfLzFC2zb8LYXqBJ1O7x86WJzA1Eeu9Fd8:TJu/yTzELYXqpO7x86kgt
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.2fc07439452f83ec562e3bc04dddf320.exe
Files
-
NEAS.2fc07439452f83ec562e3bc04dddf320.exe.dll windows:5 windows x86
aa0135aba9325ce135638402e9059e31
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetClientRect
gdi32
SelectObject
Exports
Exports
Sections
.text Size: - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 188KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 334KB - Virtual size: 333KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 98KB - Virtual size: 309KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ