Behavioral task
behavioral1
Sample
68c656568953649edccfe7d9604fe2c0_NEAS.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
68c656568953649edccfe7d9604fe2c0_NEAS.dll
Resource
win10v2004-20240419-en
General
-
Target
68c656568953649edccfe7d9604fe2c0_NEAS
-
Size
781KB
-
MD5
68c656568953649edccfe7d9604fe2c0
-
SHA1
a357dc193931709f0df13fefb67aa29a082c6cfb
-
SHA256
c227e9cb552b23d80fe7404642e062daf4d6ce315939409269afd795645a3671
-
SHA512
e9eade0883abcb01f3ecf528fc3376502f7da553be3643638fe5291fa1937f70718c0e76ce9782746309e3597bb7f85978f2f3c8730af1bd0978380cf517609b
-
SSDEEP
12288:gApI/GNTWMMLdz792VXZZfRc1Tg+OX0Nd8n2lbR7Df5jWLie5VaT7mDVadky2:gAE2TKx2ZZf2dBL8nGt7Dt+i/qMdn2
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 68c656568953649edccfe7d9604fe2c0_NEAS
Files
-
68c656568953649edccfe7d9604fe2c0_NEAS.dll windows:4 windows x86 arch:x86
0022b6d1ebc57b5ce0f32835f17fc73e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetVersionExA
GetVersion
GetVersionExA
GetVersion
GlobalAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
EndMenu
advapi32
RegOpenKeyExA
oleaut32
SafeArrayCreateVector
version
GetFileVersionInfoA
gdi32
SetViewportOrgEx
ole32
OleInitialize
comctl32
ImageList_DragShowNolock
shell32
SHGetFileInfoA
wininet
DeleteUrlCacheEntry
urlmon
URLDownloadToFileW
wsock32
gethostbyname
ntdll
NtOpenProcess
iphlpapi
GetExtendedTcpTable
oleacc
AccessibleObjectFromWindow
gdiplus
GdipGetImageHeight
imagehlp
MapFileAndCheckSumA
atl
AtlAxWinInit
ws2_32
WSAIoctl
Sections
CODE Size: - Virtual size: 782KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 14KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 775KB - Virtual size: 774KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 164B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ