ƈ����Xú��TX�笀��'��(|*�� � e'K�~��#r-���U�Lq�c8|���z� �_���Z������ǹhw��� � ��ɇYv�ԝ�Z�ku:�����?�E�VÎz�A�d�Z�N�FK�v����3r*و4#��و4l[�cG�y|�|e�N7 �VtK�¾�!��6�q�{���#!GXpn���,����A�Ax��34g�<�ږ����=�SZ��+�7D���Ҝ�Ջk7�!J|�smt��͒7/��+)����1=����X|p8��e��<����̀��Z�W��F�u��,�]��>��=�����$�1t��p�U��~ �3b��Ț�hڮ�c`�KX���'�p�[i�2�d]���6ƌb�e�4$�6 �����3t���8=[/�^�U�|F�m�S}J~rQ"2S�����2c�pY,��R���M��MUyIc��BNF��c��$���+P*�/���+�nϩ������9n��=�%OO֡�GD��iB)>�Ԇ-�'�C�z��t���P�k���k�:�_� �6<����E�.��� �u��JH�����*��N���#��u=��s&��p���|���!�vC#� �8jɔ��c����84RKq��j1�^v�C� ����-K �D�i<&-A߅�E~�ňIr�ܲ�����wr�\Da ������:R���6�X C�n�Ъ����@�-��ho����_A�0R e�wV= z�R���Ż(�+�B:�n�x����zp$I�������Fe�V;��i�"]�p������bq2���e��d�5%l��L�uJUf1��PN��\ 2�:�"Y�T1|�`Mo���8��2�r�.����0N@|2�X����R��/���]��8_jY�{���3����jD��vgX�{FH�i�ͱa����!uij欖�&�m�X�)-]�Z u4��R'M�+Nw�2���i^թ+�a�x��4?�)ɲ�N�nb\�;�< �o�6�ofL9g�VbK�=J�2�g��9[��X1Z����aK���w��6�[Y���,"���7�gH�y_�/i۸2O���cY*�耽ی�~��ÒK�j�b;�Kot$�.K��0Čr�_v�u+������Z�x5�.��r��S% �`�l�p�ʓ��v��%u��j�E����j��F��('�p������'e[uN����-q�$Zv:3��y��9�w&2r^>E��o��ܺ��ُq�=�ޯ�NJ����t$0t�0a�)軚*���;Yi�\��2�IKRa��/Z�J0k6J�Yh�:·TQ>�x�{�$6@�I���J��0雊{ۃ0}� ˜|�E�U��!���<@��և��R�� \�f�<��883���� 8fc���0��?x��1�� �P�����@ �J�#�*��9m���1s`��XT�,x�6�iM�O�s �q�y��o��y�-�̇Z�ܜz+�l�@�G�ddd�?n��Y0��U�r��Is��& ,{�����p�bdm�Cepu�a�tź�> �ۦԍ��07'T���G�P����rm0@ą�������V��Ȼz��ܹI(:>��ȷ9F�'-�M�T z�>q����F�%?��8��rV���@����� ���<�5r�?%C���m ��P��f��ی)� 1|?] v�I�Kzw��g��A`h)d�S,CX'���9��J�H����F!e��+r��!k��X��ayʊ�@հ6!Һ��=^�.����^~������$��g;R�;;lR�k?��CQ:���7Yj�(�jM�X*�`/�q��p��:0jis1F�))���A�����+��I���\��+�J�u��~��<%�'�|[ �UcsBK16�Q��+�O�eF�$3��y�E�ȇzY��֔YB�缊�7R!��L��f7 -�_'7+����Q���ʰn"�ֵ�����퐴�wV��%���`p0P���>��;�ƌAÖ�n����uU�OP|s�@7�C�Y����٤/Ҙ�rxk�g���oƝ~T���*]i�;�VГKB%��m���uG�;��D�J�ތҡ�*��?5�ĕ�y��N,,��� �D�3;:o]�e�&6����Z�m�M��e���P����IC��T�J� ��e�����ԉ��O���)��<ؙ�v�P|����2�� �]���W�+=,;t��&���O�s_����}B\��g�x�������>;�,�������pc\��LQ�;NK�)���u���&�x�?�au ��J�����Ϙ�`g���0t��|�~�|.`1��aߙ��S*��x9��֭5DE�̇�%D��?�s�ܪ:|a2q���e+�iގ?��M�س9v�ˈ�ٴ��U� k^ʍ��$�Y�b���KǐCA�F��%Ů Ղ������2q�#�����Ҳ+�/z�ܚ����Y�i���V'�d�~���RY�$������>ڛ0##|�U� �+�儱V%��Κ���^庸J5?a*���E:��!a����d��[���U���e��Ы�E'73�d���;(��s��/�#>�V��n���e>���d�:b��I�7ᶂ�G�EE�c����<�����!��w>��a���-�G�O�� d�m<:�Uz:�.�c��5p���x���Gx(��?�Z��@��U�*{���F/�� ���̤��#ǯ����L�'�J+��z�v�����ŧ?�K�� ��`���-e��:T�XQS�W�1�Q�a��ƐEW:��Y0��`����ϡU��9ZQD� ����U��K�[�I��IT�M�nw�[���4�!`�^�:������f�BP��\T��i�Z��_M���i��5�/K��}{-`�!.�7a��\�u�N��x���f��x!n{�(�)����?�Q���O�I�ue8i"�_(Q�uȵT7��6�?I��G �_Z�l^+F�{h�������I�?y�9���gn��l�ٹM� ����b{�����#�.W���B~�/M�n�D�d\�R{u>Dv�J�k_��;�'
Behavioral task
behavioral1
Sample
NEAS.383b60f87116db0011bdb75b92a95f60.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.383b60f87116db0011bdb75b92a95f60.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.383b60f87116db0011bdb75b92a95f60.exe
-
Size
3.3MB
-
MD5
383b60f87116db0011bdb75b92a95f60
-
SHA1
f04644739e123a9ebf29bc35d648094a212a4568
-
SHA256
fa2e4b2efaa905493ac4b5777da1fd942da646d884e9f6c9d23c4b4e7ff1ffc2
-
SHA512
21938fb806d94f7a3bab01a245cf31675c3b1a24533487b80f5a889b0869c76337601f9d139ea34b5c096e8ac60551e9740fbb8be6635057ff25817c5f4f0502
-
SSDEEP
98304:pyeHBs3uN9mMU7yKtD8Gt8qgxeV8FQP89zJ:MGpVU3D8Gt5gxXQ099
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.383b60f87116db0011bdb75b92a95f60.exe
Files
-
NEAS.383b60f87116db0011bdb75b92a95f60.exe.exe windows:5 windows x86
dbdfafa8afcba70d0690ad3adfed4cba
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamProperty
ws2_32
accept
kernel32
ReleaseSemaphore
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wsprintfA
gdi32
DeleteObject
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
ole32
OleIsCurrentClipboard
oleaut32
VariantCopyInd
comctl32
ord17
oledlg
ord8
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 571KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 201KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 776KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ