NEAS[.]b971144f3adc49f87a0d9e00fdaab800[.]exe | Triage

Sharing

General

Target

NEAS.b971144f3adc49f87a0d9e00fdaab800.exe
Size

80KB
MD5

b971144f3adc49f87a0d9e00fdaab800
SHA1

1d1c434657b8c0cb17c7a00ba603986fab349db7
SHA256

450b5c08230828261842ddc2e9ac8d036f0a3006afe24757e93bb2c70ce8f5cb
SHA512

bf32f3820421540d82e6c29fffdcdcab1c7d3952d595153b7aa310971ff721e543f31276e71f57fadfaace2daf3289a6d4e329d5e28aed1019d4cc7a9ca20988
SSDEEP

1536:4LKCxc6ythktVsC9bMn7PoC3txg89FpMhQu9dG0z3DURkFmiLCFit:ily6aqOn7ACE89zMfo0z3YRmmG8i

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.b971144f3adc49f87a0d9e00fdaab800.exe

Files

NEAS.b971144f3adc49f87a0d9e00fdaab800.exe
.exe windows:4 windows x86

ef8ac61f0a72dfe2a00756a6b4e83db4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

atl

ord42

gdi32

BitBlt

gdiplus

GdiplusStartup

msimg32

AlphaBlend

msvcrt

atoi

ole32

CoInitialize

oleaut32

VariantClear

shell32

DragFinish

shlwapi

StrToIntExA

user32

GetDC

wininet

InternetOpenA

Sections

UPX0
Size: - Virtual size: 496KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 74KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE