NEAS[.]cc73654317d0e52553f1f9e1bdbbc2f0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.cc73654317d0e52553f1f9e1bdbbc2f0.exe
Size

1.2MB
MD5

cc73654317d0e52553f1f9e1bdbbc2f0
SHA1

8fe1fc72da9599a59392ea784fc89101a8057468
SHA256

3baf364955a64581f8984c9c76ca68a9a104f6747ee00fd2d2033a29edc84cbb
SHA512

35fa5c4ff9386c71403f74a4f6517bf6b31da264f56472ff58666e4617b75a86f0cd523e9460c3bafca7b04c6345d887982bec2b630ad214b79227a209f941d5
SSDEEP

24576:LFswRZRNfmbnRTYBHO6hAnfI3oTMkEbpQNJyL41FzbOO9D8CuQ:LFdRkBf6MfI3qMkEbpAJBnNV82

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
sample	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
NEAS.cc73654317d0e52553f1f9e1bdbbc2f0.exe
unpack001/out.upx

Files

NEAS.cc73654317d0e52553f1f9e1bdbbc2f0.exe
.dll windows:6 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

ares_cancel
ares_create_query
ares_destroy
ares_destroy_options
ares_dup
ares_expand_name
ares_free_data
ares_free_hostent
ares_free_string
ares_freeaddrinfo
ares_get_servers
ares_get_servers_ports
ares_getaddrinfo
ares_gethostbyaddr
ares_gethostbyname
ares_gethostbyname_file
ares_getnameinfo
ares_getsock
ares_inet_ntop
ares_inet_pton
ares_init
ares_init_options
ares_library_cleanup
ares_library_init
ares_library_init_mem
ares_library_initialized
ares_parse_a_reply
ares_parse_aaaa_reply
ares_parse_ptr_reply
ares_process
ares_process_fd
ares_query
ares_save_options
ares_search
ares_send
ares_set_local_dev
ares_set_local_ip4
ares_set_local_ip6
ares_set_servers
ares_set_servers_csv
ares_set_servers_ports
ares_set_servers_ports_csv
ares_set_socket_callback
ares_set_socket_configure_callback
ares_set_socket_functions
ares_set_sortlist
ares_strerror
ares_timeout
ares_version
curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_option_by_id
curl_easy_option_by_name
curl_easy_option_next
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_easy_upkeep
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_global_sslset
curl_maprintf
curl_mfprintf
curl_mime_addpart
curl_mime_data
curl_mime_data_cb
curl_mime_encoder
curl_mime_filedata
curl_mime_filename
curl_mime_free
curl_mime_headers
curl_mime_init
curl_mime_name
curl_mime_subparts
curl_mime_type
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_poll
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_multi_wakeup
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_pushheader_byname
curl_pushheader_bynum
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_url
curl_url_cleanup
curl_url_dup
curl_url_get
curl_url_set
curl_version
curl_version_info

Sections

UPX0
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:6 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 542KB - Virtual size: 542KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 1.4MB

UPX1 Size: 1.2MB - Virtual size: 1.2MB

.rsrc Size: 5KB - Virtual size: 8KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 542KB - Virtual size: 542KB

.data Size: 22KB - Virtual size: 39KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 75KB - Virtual size: 74KB

UPX0
Size: - Virtual size: 1.4MB

UPX1
Size: 1.2MB - Virtual size: 1.2MB

.rsrc
Size: 5KB - Virtual size: 8KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 542KB - Virtual size: 542KB

.data
Size: 22KB - Virtual size: 39KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 75KB - Virtual size: 74KB