E�[�檣߀$l��鋯��_؛5MI��t7!s�ᡡ�[II�G���r.�D��C��oA��Ғ��a�1��m����);r9�P.�_.��"�M�PP��`x�w?i:�^3��*X����͉�ߕf"?�7y]�C�d'\�M�VsxR�����������*h��҃|4���Cբ�̆י���Az��b9J Y��>�K�{�%���A�{L�z�X~� 2 ���ƄXĵ%>�hv`���~�<V��H�9ffa��f����9!�m�|���^3rvr ҄�S��1"�����6�PN:r�����tN:��,�hz76h � 03)�>���qW9� �������*&��b>�J%���&��X̞8��F�����D�PZ�n��Eٚ�0x�j"e��H j6�:�o*�w�2&!��ԢhwN��]����GzТ��MV�~�z>wHz�_��j�spׇ�]M���1�4AG1���'�|5ъ�馣y�I��J�c�o��3���0�밊R�<%bW��y���U=k�0�ޏ�_!.��&Z��K雵���Jb���#��1*R��Ϟ���KD�!b��E��]��3���O�f����~�,��[3�<� �&{�ͅt�"SUmR�=^`@OО��\��ՠ��&����b�i��0�:v�/Tׇ�W�m~}w��'sj�!��&n�* Mbs4��aD����W��>��E7;�Ʀ�\w˝_�;b5���s�Ho+�+E�r;��Ƃ�w{2ىL|i\����hV3X�a8����X3xea���r)/��bV^�1������$�2��~��dY�5��0����(ꉤ��� P�R�� s��y�.,�RW�ҹ��܉^�]��٠m���2���%�U����� ܌�I��J���9v_���IE�\��Vjz�: ��!7���Z'��Rp������A�v�v��G�X�����jМ�-�-���E�ːPv�fSA���s������nn�x<k'�t<���9a8�X�XЃ ���F��!���u�۰bMH���?z��X���:@�շ�n2��@�2�*��/�_�����*ť�W��.(<+�� �@:�V�[�:�se&�f���F�[��zrz@S}��mK��G 1~�F�?�_�����)���z���`?�0Y�r �����ڈ���߭kL�E2���Qך�w���E��r��,��~x-��q�����_�Z��1����e>��ѵ��j�h;�{��wq\^��r�]+B/0���_Ȁ����O/�c�&����o��8��j����Zd����'����6^אt]�z5D��� 3��S`?�-S�����kՋ7�km��j�<�p�i�K�j�}x|'lx�C�W����_��\���&�n��s�t��oA���)�3^�a����s��5�~�`�N�{s��!�R�:�λ㹎�u�.�$]ͱP�QVE1��/��{��Ժ��$to�Z��I�Xd������p��A�F�e�Bc���{sb,n\;9_ru��w]�V�~����ԟz̭z�����3�Rgŵ����ߙ��k�$`3㠈��_��b����|�Go���'�)(�rDwMB~��P~^ �P�{��G���.� z��| �]��>� �-��<N��;�b��k�a���f��Z�kb���g]��7b�`-n����;�������<֊�X�f�eZQ��J�y�Ĭxۥ{ "�q˜�f�4������H��>��x�K`�>�:�>D\��v_�tp�ڸ��|����;���35����J%ˏ��e_]ಒ���v�sW���*m�.r�* �Ś�w��Y�C�k)'���������ZvԬ��`����_�π1�@E���im�z�p~��yYK*�_�{�<�Je+�u�$E�T�"Bm�!Z��hŜ����z��α�Z�d,�u���op�h���� h���1!�z�M�@��>�CН&>AY����C)�@C�������Ctc8gq�K�0�1፭tG]o��nN�D_B"��W�27aZ���W0�������9�I#}&�~�WI{���i�8�坜���/����6�v���-HP;+H�,�]�2y���E�0F�2��p-h�J��-h �1`���ou�j��[����J4ww8���ʪw�2���'2�B�&�B}��b�m(Oy�$�7$8�G;�tp<��ڦ.`�ל�à�x^v7`��<K{�Y��b�2��p��)��F*1OM��^h�\L�C�Qc�_d��k~'tt��Ṙ7��i��}���b�G�T%2�K��Z�,��=9�n��s+����o��Ϫ�H}�qD��pP����j��|����q���X�F�ԁ��O�韡�\O\��������c3_��KԀ� tf�O�m��O�\Oh���9���Zv6�k�x���/xr���̎�G!V�����/ej-ėJ��$�����xȁ�+���hvB<l��s�ȲfhĂ� 6l��[?�S52��(�V=�A��5u�����Xkn�]N[|2z�y��>g'Dٴ<�qh��q0td8�i��OG��o��/ԈF� ^<P��=�W����f�� `�5 T�S�߸�5Q)��2gt��8���\�a�F\��wz��9�$�}���F�<��H�Y�Z����6�2�Xz�bɸ�}�������J)�D�S�"�*��=���/�"��(6�����ss<I^�g�m�a9��e;Y��A��CF��i���O�W���K�M�Ϭ����A�͛�on��{,QJ �Z�n(����ڃ}�\���p�Gn���>,�ݖmv�8ꮠ.�;!�{�a���V�$iW��X�#E�¥3��m�Ȋ�ǫ)NLr�#��Ӡ��?B����I�`�M�5���w�u���?@��M��>�5���% ��v�5�b���*i�b�Lj�3��jS������8����s=����>��a���H��a���O�h�i��oC� L �0ݩ�C�zL+ٌ��������r�c���AD��� B8��c��nX=���e�vҝ1u����3���N���wj�����G
Behavioral task
behavioral1
Sample
NEAS.011b0986622e54b9c340a20cb59cbc50_JC.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.011b0986622e54b9c340a20cb59cbc50_JC.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.011b0986622e54b9c340a20cb59cbc50_JC.exe
-
Size
232KB
-
MD5
011b0986622e54b9c340a20cb59cbc50
-
SHA1
8c1f979f105a6e2805e44a30f2859b8ddcd24ef5
-
SHA256
6f2c714741f05e83c4c1d149e2cab5dcf5babecb38eaa023dcb671a1aa44fc2b
-
SHA512
7985b1b11bed80090457a4949854d558bf94126544319a83d3c0b8677c519ca8d6603e62dcda8cf6d3446aa7e5e8d71825ecce2491b8100871b10be8404bbb98
-
SSDEEP
6144:+t1oX8S5J3wKXLGFzzGvAExjaJPnMn0jTNKtAjD:eobxwkqFzbExjah085KtuD
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.011b0986622e54b9c340a20cb59cbc50_JC.exe
Files
-
NEAS.011b0986622e54b9c340a20cb59cbc50_JC.exe.exe windows:4 windows x86
999f0ae4ca3dbead6359b6974f056340
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord546
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 361KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 129KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 220KB - Virtual size: 218KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE