NEAS[.]fdecbe3d222a3e3e8a9c4c8d67948ef0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.fdecbe3d222a3e3e8a9c4c8d67948ef0.exe
Size

59KB
MD5

fdecbe3d222a3e3e8a9c4c8d67948ef0
SHA1

ff8b323598a8eeabbf0036828e4d463bd757659f
SHA256

2c5fba29bc92b31336cac1d15cc6737b095ce47299f537c297d4ac9f6cc003a0
SHA512

bd54792f2d04505df372c8e1eec85795b519cb21330db74d5ccdea91aa6048c5a1351dd01b17a8c683eada375869c4fe82dbb4fb806b5a97d1cfb06852b06320
SSDEEP

768:N+CLZoyIm5mn0000IFL8VlVJovlNHBvBPcFhl1WVe8gbxfxhSOZ3u:N51tI/nIFLcJonhpPcjiebbxpho

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Files

NEAS.fdecbe3d222a3e3e8a9c4c8d67948ef0.exe
.exe windows:5 windows x86

Code Sign

37:50:e6:c8:8d:47:70:3b:59:3b:a1:6b:57:ac:3e:89:82:52:2a:b4
Signer

Actual PE Digest

37:50:e6:c8:8d:47:70:3b:59:3b:a1:6b:57:ac:3e:89:82:52:2a:b4

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

UPX0
Size: 14KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.imports
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE