NEAS[.]2fedb9098bf150a3ac819cc78b322bd0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.2fedb9098bf150a3ac819cc78b322bd0.exe
Size

348KB
MD5

2fedb9098bf150a3ac819cc78b322bd0
SHA1

c1d3085980252dc4febae4d21f2bad3ee1dc71f2
SHA256

39ea7582446d4053dc24c17478fb61a86ca28f9c5181a0ac6fb2a34351685a47
SHA512

b0cd33bf83f2a04ff04919e2117297c4fa8e975bf023a54e9956b84ddc32dfdcd6385bf9cf8a23623a39ccab80aea2cbda05902105db51397e9893ec4a399e39
SSDEEP

6144:4Gunw5Ln9nkP+6bfbSxbS22d0/B+3tpVxbSQRB/B+ybSkTb+3bS7/B+DbSWZGn:R5ju+AeX2I2tp/RZDTb+rqUnE

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
NEAS.2fedb9098bf150a3ac819cc78b322bd0.exe
unpack001/out.upx

Files

NEAS.2fedb9098bf150a3ac819cc78b322bd0.exe
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.bss
Size: - Virtual size: 26KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE