neshta | easy_Malicious_12d369853741ef343bc7f082f85a0e9e93f5db49da7da0ef8c135f2631cf1dc0[.]exe | Triage

Sharing

General

Target

easy_Malicious_12d369853741ef343bc7f082f85a0e9e93f5db49da7da0ef8c135f2631cf1dc0.exe
Size

40KB
MD5

938dbb428b7d3389c8bd083fda75ccfb
SHA1

142c48fa05137ee8abc2f859d1e2006cc865e212
SHA256

ea03cea93ac02e83ae0427cccdf0f4bc04feff6b10e71555d3df5822fb71576e
SHA512

6069abca07f71768c0521811b8d715bb8d0d3dd41d7cf8ba76f3299685ef5c1f807360b1002f90eab8183b6a664228a86ef939f545963ea50c64e42f3206f040
SSDEEP

768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJT:JxqjQ+P04wsmJC4

Score

10^/10

neshta

Malware Config

Signatures

Detect Neshta payload 1 IoCs

resource	yara_rule
sample	family_neshta

Neshta family
neshta

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
easy_Malicious_12d369853741ef343bc7f082f85a0e9e93f5db49da7da0ef8c135f2631cf1dc0.exe

Files

easy_Malicious_12d369853741ef343bc7f082f85a0e9e93f5db49da7da0ef8c135f2631cf1dc0.exe
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 42KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ