NEAS[.]12779738015a43d4951af88cb717acc0_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.12779738015a43d4951af88cb717acc0_JC.exe
Size

492KB
MD5

12779738015a43d4951af88cb717acc0
SHA1

b6c67ebbbbeac85d8fc2fe246ad64b9b0cde51cd
SHA256

1cb9f7c39de2a72fa2b1caa74970dfbfae5697b7c476e21b80e424eeaa55cdc4
SHA512

4fd1bb9a1545ac88f05510039f94d9e3823cd344e241e00cde5e0c2310de8e5557d147908cb1b582ec242e7fe7678619c5fdbf7ad203fd4b602c9fd41c18e306
SSDEEP

12288:5+Zgna9JBw7uwih/I34wrSMIeXylqj5eujE33EacVqvla40tO:51aRwywUI34w2MR5eujE2V9LO

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.12779738015a43d4951af88cb717acc0_JC.exe

Files

NEAS.12779738015a43d4951af88cb717acc0_JC.exe
.exe windows:5 windows x86

9c1e90d20edb215c6e3ffa883d28f686

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapCreate
VirtualFree
OpenProcess
TerminateProcess
IsBadWritePtr
LCMapStringW
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadCodePtr
SetStdHandle
LocalAlloc
LocalFree
CloseHandle
OpenEventA
CreateEventA
CreateToolhelp32Snapshot
Process32First
Process32Next
CreateDirectoryA
MoveFileA
CreateThread
RtlMoveMemory
GetTickCount
LCMapStringA
LoadLibraryA
GetProcAddress
FreeLibrary
GetCommandLineA
GetStartupInfoA
CreateProcessA
SetFileAttributesA
FindFirstFileA
RemoveDirectoryA
DeleteFileA
FindNextFileA
FindClose
GetModuleFileNameA
CreateFileA
WriteFile
Sleep
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetModuleHandleA
GetProcessHeap
SuspendThread
WaitForSingleObject
ResumeThread
TerminateThread
QueueUserAPC
GetLastError
HeapDestroy
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
VirtualAlloc
GetCurrentProcess
FreeEnvironmentStringsW
FreeEnvironmentStringsA
lstrlenA
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetCurrentThread
lstrcmpiA
lstrcmpA
GlobalDeleteAtom
GlobalAlloc
GlobalLock
TlsAlloc
GlobalFree
GlobalUnlock
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
lstrcpynA
GlobalFlags
InterlockedDecrement
WritePrivateProfileStringA
lstrcatA
lstrcpyA
InterlockedIncrement
SetLastError
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetVersion
GetProcessVersion
SetErrorMode
SetFilePointer
FlushFileBuffers
GetCPInfo
GetOEMCP
RtlUnwind
RaiseException
HeapSize
GetACP
UnhandledExceptionFilter
InitializeCriticalSection
GetModuleFileNameW
GetModuleHandleW
TerminateProcess
GetCurrentProcess
DeleteCriticalSection
LoadLibraryW
CreateEventW
CompareStringW
SetLastError
GetModuleHandleA
VirtualProtect
GetTickCount
EnterCriticalSection
LeaveCriticalSection
VirtualFree
VirtualAlloc
WriteProcessMemory
CreateToolhelp32Snapshot
GetCurrentProcessId
GetCurrentThreadId
Thread32First
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
GetSystemInfo
FreeLibrary
LoadResource
MultiByteToWideChar
WideCharToMultiByte
FindResourceExW
FindResourceExA
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
GetSystemTime
GetLocalTime
SystemTimeToFileTime
CompareFileTime
GetCommandLineA
GetLastError
HeapFree
HeapAlloc
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetStdHandle
GetModuleFileNameA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetSystemTimeAsFileTime
HeapReAlloc
HeapSize
LoadLibraryA
GetLocaleInfoA
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InitializeCriticalSectionAndSpinCount
VirtualQuery
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

MsgWaitForMultipleObjects
GetWindowTextA
SendMessageA
FindWindowA
SetWindowPos
PostMessageA
SendMessageTimeoutA
DestroyMenu
LoadStringA
GetSysColorBrush
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
IsWindow
EnableWindow
GetParent
IsWindowEnabled
GetForegroundWindow
GetActiveWindow
SetForegroundWindow
PostQuitMessage
SetCursor
GetWindowLongA
GetLastActivePopup
SetWindowsHookExA
GetCursorPos
IsWindowVisible
ValidateRect
CallNextHookEx
GetKeyState
GetNextDlgTabItem
GetFocus
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
GetClassNameA
PtInRect
GetWindowRect
GetDlgCtrlID
GetWindow
ClientToScreen
SetWindowTextA
UnhookWindowsHookEx
GetMenuItemCount
GetDC
ReleaseDC
TabbedTextOutA
DrawTextA
GrayStringA
GetDlgItem
SetWindowLongA
ShowWindow
SetFocus
GetSystemMetrics
GetWindowPlacement
IsIconic
SystemParametersInfoA
RegisterWindowMessageA
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
DestroyWindow
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
GetClientRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadIconA
LoadCursorA
UnregisterClassA
MessageBoxW
CharUpperBuffW
wsprintfW

advapi32

OpenProcessToken
RegCreateKeyExA
RegSetValueExA
RegCloseKey
GetTokenInformation
RegOpenKeyExA

winhttp

WinHttpOpen
WinHttpSetTimeouts
WinHttpConnect
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpSetOption
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpCrackUrl
WinHttpQueryHeaders
WinHttpCheckPlatform

gdi32

DeleteObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetDeviceCaps
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetTextColor
SetBkColor
SelectObject
RestoreDC
SaveDC
DeleteDC
CreateBitmap
GetStockObject
GetObjectA

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

comctl32

ord17

shlwapi

PathFileExistsA

shell32

SHGetSpecialFolderPathA
ShellExecuteA

Sections

.text
Size: - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 448KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 488KB - Virtual size: 485KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9c1e90d20edb215c6e3ffa883d28f686

Headers

File Characteristics

Imports

kernel32

user32

advapi32

winhttp

gdi32

winspool.drv

comctl32

shlwapi

shell32

Sections

.text Size: - Virtual size: 140KB

.rdata Size: - Virtual size: 16KB

.data Size: - Virtual size: 118KB

.vmp0 Size: - Virtual size: 448KB

.vmp1 Size: 488KB - Virtual size: 485KB

.text
Size: - Virtual size: 140KB

.rdata
Size: - Virtual size: 16KB

.data
Size: - Virtual size: 118KB

.vmp0
Size: - Virtual size: 448KB

.vmp1
Size: 488KB - Virtual size: 485KB