Static task
static1
General
-
Target
aa603a1e4874a19e331322ac204fdc615b9e2c8eff810336a9540d4c7c5d0d38
-
Size
328KB
-
MD5
23e421072b6ebe8b53fde252e6990340
-
SHA1
9a9f0b8fc33435bb8c29c55ff261b88e8b96eafa
-
SHA256
aa603a1e4874a19e331322ac204fdc615b9e2c8eff810336a9540d4c7c5d0d38
-
SHA512
6a0ce5b2494eacdec720e107605f95c2058fe75f8a52d72783b8dbbc2d9072a694c9a0f9eec07afc8e441fe2a88237121a2784c3f92ab44b622fc5938dc4d468
-
SSDEEP
6144:k9hCJ6MwIAVM/+VNZaD5bViXcjuOCcAMXFDDPc/uGsjmGsj1:eCQXBVNu5ljuOtAwzO5
Malware Config
Signatures
-
Detect Neshta Payload 1 IoCs
Processes:
resource yara_rule sample family_neshta -
Neshta family
Files
-
aa603a1e4874a19e331322ac204fdc615b9e2c8eff810336a9540d4c7c5d0d38.exe windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 1024B - Virtual size: 536B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 42KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ