NEAS[.]53834bc91f8db83114abf5598ffc6c40[.]exe | Triage

Sharing

General

Target

NEAS.53834bc91f8db83114abf5598ffc6c40.exe
Size

320KB
MD5

53834bc91f8db83114abf5598ffc6c40
SHA1

753039af39df0b3779775903fb9dd1bbcefdec5c
SHA256

a8975651240db4bb9863196aaa5f83395196b1b96da4cecda4bfaddf0ef29704
SHA512

e89938d8f1a1cd897893047c5926f019dac6de90c4e79fb732c0eddfb0e989ca941bf126c6e1f347d453e490cd3a8220f0758e47c61be2b61facaa00deb624a8
SSDEEP

6144:mRjnuNIKZaHTtqMU4KVMBT8Ep0QCdnbz/8doIywdWWE8AuVr2QXa:m1uNo9U4AI0/xuoIygysz

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.53834bc91f8db83114abf5598ffc6c40.exe

Files

NEAS.53834bc91f8db83114abf5598ffc6c40.exe
.dll windows:4 windows x86

0c0bc1ed9324a1279725b2fd457b9bb1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Sleep
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

SendMessageA

Sections

.text
Size: - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 244KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 312KB - Virtual size: 309KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ