NEAS[.]9ff971ae2ce36b0e79bce25f19450890[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.9ff971ae2ce36b0e79bce25f19450890.exe
Size

3.2MB
MD5

9ff971ae2ce36b0e79bce25f19450890
SHA1

9071632f4031ac24a48cd2fcdd7ba3862fe58413
SHA256

748a62c20e3226b5982f219b12350cf5b0409dc563635d69ce0fe44d9a9f1d55
SHA512

c52273e629642aec7e6b18486cc181d5540205fdd4e51a631c0e30788ec82407c2617f1355b411700c007e61cbb8b54a025083b339ff33010b1252dafd5d3372
SSDEEP

98304:iYig8Dt+iXJynMvZQoP9xXnC0b8W2iizwRz:x8D4iZAMFPLvB2ze

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.9ff971ae2ce36b0e79bce25f19450890.exe

Files

NEAS.9ff971ae2ce36b0e79bce25f19450890.exe
.exe windows:5 windows x86

09d7e7939ef191080edaeab95c70d9db

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetProcAddress
GetStringTypeW
MultiByteToWideChar
LCMapStringW
HeapReAlloc
HeapSize
RtlUnwind
GetCommandLineA
HeapSetInformation
RaiseException
SetUnhandledExceptionFilter
GetModuleHandleW
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
HeapFree
IsProcessorFeaturePresent
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
Sleep
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

ws2_32

recv
closesocket
connect
inet_addr
htons
WSACleanup
socket
WSAStartup

user32

GetProcessWindowStation
GetUserObjectInformationW

Sections

.text
Size: - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

09d7e7939ef191080edaeab95c70d9db

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ws2_32

user32

Sections

.text Size: - Virtual size: 27KB

.rdata Size: - Virtual size: 11KB

.data Size: - Virtual size: 6KB

.vmp0 Size: - Virtual size: 1.5MB

.vmp1 Size: 3.2MB - Virtual size: 3.2MB

.reloc Size: 1KB - Virtual size: 1KB

.rsrc Size: 27KB - Virtual size: 26KB

.text
Size: - Virtual size: 27KB

.rdata
Size: - Virtual size: 11KB

.data
Size: - Virtual size: 6KB

.vmp0
Size: - Virtual size: 1.5MB

.vmp1
Size: 3.2MB - Virtual size: 3.2MB

.reloc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 27KB - Virtual size: 26KB