NEAS[.]582d2bce0e640d951384375242458900[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.582d2bce0e640d951384375242458900.exe
Size

2.4MB
MD5

582d2bce0e640d951384375242458900
SHA1

1b352ecb962fbe3fda54b427af455a0f65028874
SHA256

1f3dbd74bf82d183581759cb3a4b8d4d34d8f43bc6dc1d44bbcabbe4d047ba13
SHA512

fa39b50b1b689d2c538ed65375974b75748d32876fa1cb76d16c3e210fb2d017fa15134c2205bc212679440a078692647cb3689734f98799e5e51b9fa740f486
SSDEEP

49152:tnJwLEXCi0nZa3gkrI/Q7S9iyQ7/ZZMqj3RHwyxMG7wQz:3aowX/Qe9iyQFZMqjB3xMGkI

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.582d2bce0e640d951384375242458900.exe

Files

NEAS.582d2bce0e640d951384375242458900.exe
.exe windows:5 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 2KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 133KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 1KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ