NEAS[.]0cae5470996d085decd2bd7f8731d1c0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.0cae5470996d085decd2bd7f8731d1c0.exe
Size

2.1MB
MD5

0cae5470996d085decd2bd7f8731d1c0
SHA1

06e84056cb03551304a8936d52d9456753a213c5
SHA256

fafbdbe85f4cc55022a6d1585b0634fb5228bafe1e5a61c8d44fa7e18ee14373
SHA512

82099c7e6be6a4216137caf51d7cfa44415e5a06320f2150f4b5179a08847ed95a2a09c7c7ace7a34868ca32bf381364e7cb923f2be6e060c8a4d23bc8619d5b
SSDEEP

49152:LjWDUtQxG3iA9VJIzKVYMqqX5puJTsCytaPGujXEofJ:PwU28VJJpNaTsCy4PYofJ

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.0cae5470996d085decd2bd7f8731d1c0.exe

Files

NEAS.0cae5470996d085decd2bd7f8731d1c0.exe
.exe windows:5 windows x86 arch:x86

1cd5e42922b868bf8af4fdee5525c166

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

rasapi32

RasGetConnectStatusA

winmm

waveOutClose

ws2_32

send

kernel32

TerminateProcess
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

GetWindowPlacement

gdi32

Arc

msimg32

GradientFill

winspool.drv

ClosePrinter

advapi32

RegQueryValueExA

shell32

SHGetSpecialFolderPathA

ole32

OleInitialize

oleaut32

UnRegisterTypeLi

comctl32

ord17

wininet

InternetOpenA

comdlg32

GetOpenFileNameA

Sections

.text
Size: - Virtual size: 501KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 970KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 257KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 847KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1cd5e42922b868bf8af4fdee5525c166

Headers

File Characteristics

Imports

rasapi32

winmm

ws2_32

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

wininet

comdlg32

Sections

.text Size: - Virtual size: 501KB

.rdata Size: - Virtual size: 970KB

.data Size: - Virtual size: 257KB

.vmp0 Size: - Virtual size: 847KB

.vmp1 Size: 2.1MB - Virtual size: 2.1MB

.rsrc Size: 8KB - Virtual size: 6KB

.text
Size: - Virtual size: 501KB

.rdata
Size: - Virtual size: 970KB

.data
Size: - Virtual size: 257KB

.vmp0
Size: - Virtual size: 847KB

.vmp1
Size: 2.1MB - Virtual size: 2.1MB

.rsrc
Size: 8KB - Virtual size: 6KB