urelas | NEAS[.]799438e8de64831209fd6d8e0b8324c0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.799438e8de64831209fd6d8e0b8324c0.exe
Size

166KB
MD5

799438e8de64831209fd6d8e0b8324c0
SHA1

9443a7a5095e090dabbd62653154c5b21483a25a
SHA256

83be85c84da62dc60418fa632b237e74245ac4b5a69715804621896cc4471ca2
SHA512

4ac12f375102f79a05527fa1e1a866639d81a9a230d987e0df327575a68c64515cc8bd4014791f22d34e2f04faf4214dc62f6b4874c370bec817258562525b89
SSDEEP

3072:t9AJRSvTvHN7xkKGsfPNGhoIPpPVUw2II9:t9AvSLvHNdkKGbHPpP+w49

Score

10^/10

urelas

Malware Config

Signatures

Urelas family
urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.799438e8de64831209fd6d8e0b8324c0.exe

Files

NEAS.799438e8de64831209fd6d8e0b8324c0.exe
.exe windows:5 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.text
Size: 60KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 47KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

GTDTSYDW
Size: 26KB - Virtual size: 28KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ