Behavioral task
behavioral1
Sample
NEAS.c92a01e376375cad20d98b65ace62df0_JC.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.c92a01e376375cad20d98b65ace62df0_JC.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.c92a01e376375cad20d98b65ace62df0_JC.exe
-
Size
9.1MB
-
MD5
c92a01e376375cad20d98b65ace62df0
-
SHA1
954bfd71498fb2b67caec19a190e239475a87e54
-
SHA256
83b1d2337b4974c2c06d4cb4b5d34b995f6afdd1ca8610bd2fc81461d04a11e0
-
SHA512
cc3b80cdfa9106fc5e31679d41722ebc7ab8ae1b677e3162e76d8076213eaf34e89a1b6dd6edce7445a08cac25383d48eec325d40f9421d8e38f94123f855126
-
SSDEEP
196608:EcW4N0cZNk1OB66G62/+iPhMfarnrvk4coEU9lkLPb+c:EruLZNZIz62Hayrnr7EFLPyc
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.c92a01e376375cad20d98b65ace62df0_JC.exe
Files
-
NEAS.c92a01e376375cad20d98b65ace62df0_JC.exe.exe windows:6 windows x64
613d7f9d1fada6e55cd5eea4b86309a0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
opencv_world440
?fastFree@cv@@YAXPEAX@Z
gdiplus
GdipDeleteFont
libcrypto-1_1-x64
BIO_new_mem_buf
libssl-1_1-x64
OPENSSL_init_ssl
mfc140u
ord4011
kernel32
DeleteCriticalSection
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
IsWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateCompatibleBitmap
shell32
ShellExecuteW
comctl32
InitCommonControlsEx
ole32
CreateStreamOnHGlobal
oleaut32
VariantClear
msvcp140
?_Xbad_alloc@std@@YAXXZ
ws2_32
WSAGetLastError
crypt32
CertCloseStore
vcruntime140
__RTDynamicCast
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-convert-l1-1-0
_strtoi64
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
api-ms-win-crt-locale-l1-1-0
setlocale
api-ms-win-crt-filesystem-l1-1-0
_access
api-ms-win-crt-string-l1-1-0
wcscpy_s
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
api-ms-win-crt-math-l1-1-0
modf
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 426KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 33B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 11.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 8.8MB - Virtual size: 8.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 248KB - Virtual size: 248KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ