NEAS[.]4b2c5851433039010a2fcf07576dba70[.]exe | Triage

Sharing

General

Target

NEAS.4b2c5851433039010a2fcf07576dba70.exe
Size

828KB
MD5

4b2c5851433039010a2fcf07576dba70
SHA1

5f995e7635a6800246c25c2c80ba157d0e998d53
SHA256

074d886d8c8f69d55fcb417fc75d2ef83d0d74ad5893dab3db6b5950812ec797
SHA512

5341dde0208e781de43dbf2a9d7966b1c29263990381c6c490fee6f415a1937fc5d2b2feb1168f0d53c291685647ee861e795a2a2bffc03a6fba27b628a14342
SSDEEP

12288:y1MGDJLNN7Y+htZWRsXcyyXo/JR6ZPrXKhxoPk3r4seBjvrEH70:dGDJz71NesXlB/r6ZDKhxo4r4sYrEH70

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.4b2c5851433039010a2fcf07576dba70.exe

Files

NEAS.4b2c5851433039010a2fcf07576dba70.exe
.dll regsvr32 windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetPluginInterface
adler32
compress
crc32
deflate
deflateEnd
deflateInit2_
deflateInit_
get_crc_table
inflate
inflateBackInit_
inflateEnd
inflateInit2_
inflateInit_
inflateSyncPoint
jpeg_CreateCompress
jpeg_CreateDecompress
jpeg_abort_compress
jpeg_abort_decompress
jpeg_destroy_compress
jpeg_destroy_decompress
jpeg_finish_compress
jpeg_finish_decompress
jpeg_read_header
jpeg_read_scanlines
jpeg_resync_to_restart
jpeg_set_defaults
jpeg_set_quality
jpeg_simple_progression
jpeg_start_compress
jpeg_start_decompress
jpeg_std_error
jpeg_stdio_dest
jpeg_stdio_src
jpeg_write_scanlines
uncompress

Sections

UPX0
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 556KB - Virtual size: 556KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 195KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE