NEAS[.]dba43bd131c657a99b46c44dc3553f40[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.dba43bd131c657a99b46c44dc3553f40.exe
Size

100KB
MD5

dba43bd131c657a99b46c44dc3553f40
SHA1

8a39d43543ec29e583c877bf58cb38382a454f58
SHA256

1ef562e8c7323ecc072324a375af5d2f66d79ceb03465cc21f8f562a060d354e
SHA512

d05723c61ccd3ddcc93d0fe64ae16ae096f29883b4d4395dc1b4a298babd2b9aefce3fc331ea2a08f999429e15e70824573f328913f82924662b967c9399a018
SSDEEP

1536:8guawUnnfdxRV9LxNQSD69PhscG1+aTbNHCV+G7lo5N98L2Qx4TfIt/gRqyin:FuawgVV99PDqPhy1PNoZ6f98ab0m2n

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
NEAS.dba43bd131c657a99b46c44dc3553f40.exe
unpack001/out.upx

Files

NEAS.dba43bd131c657a99b46c44dc3553f40.exe
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 176KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 97KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 256KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ