441a118c49602c5fb899aa5d4ae5f790_NeikiAnalytics | Triage

Sharing

Copy URL Twitter E-mail

General

Target

441a118c49602c5fb899aa5d4ae5f790_NeikiAnalytics
Size

292KB
MD5

441a118c49602c5fb899aa5d4ae5f790
SHA1

11092e5f1dca3d68886e7b8fcc6bf68646e4f871
SHA256

48c76ca44ea28ae543216cecd869aea4ad31c865c1080497b16493830ce908ff
SHA512

ef926242576f0057aaee2498b5cd8528d1e051c9280c501fde707277e716fc871721265633ea67fb428ab30456f46fe8b238c6ba48a43897d050adeb0af3e712
SSDEEP

6144:DEpZ8FBJd1qs8XZru4bIA7wFtz924R1EAW7xTXlDofqu4:AX0BFcJXEFN924RmFVXWz4

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
441a118c49602c5fb899aa5d4ae5f790_NeikiAnalytics

Files

441a118c49602c5fb899aa5d4ae5f790_NeikiAnalytics
.dll windows:4 windows x86 arch:x86

0226f17da3bf2f12f37a68e776af3792

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ReadProcessMemory
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

UnhookWindowsHookEx

Sections

.text
Size: - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 284KB - Virtual size: 282KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ