neshta | e615a06c4539fc5fabedd46658fdc2ff534d0173f9043162f3809ef3002f0a2c[.]zip

General

Target

e615a06c4539fc5fabedd46658fdc2ff534d0173f9043162f3809ef3002f0a2c.zip
Size

474KB
MD5

7f9adcb688c6cf5c1910a6a8bc5cee14
SHA1

c598ca1d1556b9691b4096b865662fba03ad0fdb
SHA256

a77e709b70ec46539ce939b203e698593d36c1db045c878f86aeecdd37286830
SHA512

bd7f47c700cf8584b59e20f977769abd689cacd3855c55c072cdf77743f4ff559a0a678a18a8e3a75d95e3f523ef3fbe0f25f7e813d8a9655193dc7845912674
SSDEEP

12288:QAW4BzIwKJzbjoTUmZVa+sMn7dBcR9DZecLRyo56zxj79:RW4Z5mzbjyXPa+r7dUx3LRst79

Score

10^/10

neshta

Detect Neshta payload 1 IoCs

resource	yara_rule
static1/unpack001/e615a06c4539fc5fabedd46658fdc2ff534d0173f9043162f3809ef3002f0a2c.exe	family_neshta

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/e615a06c4539fc5fabedd46658fdc2ff534d0173f9043162f3809ef3002f0a2c.exe

e615a06c4539fc5fabedd46658fdc2ff534d0173f9043162f3809ef3002f0a2c.zip
.zip

Password: infected
e615a06c4539fc5fabedd46658fdc2ff534d0173f9043162f3809ef3002f0a2c.exe
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 42KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ