NEAS[.]f77b8f6147c45f33000a3d56ef395360[.]exe | Triage

Sharing

General

Target

NEAS.f77b8f6147c45f33000a3d56ef395360.exe
Size

2.1MB
MD5

f77b8f6147c45f33000a3d56ef395360
SHA1

8a0670085fd48e96bd800dbfdbb402212e1813ae
SHA256

a6d6a8bf0e3694dced3d373c9979f094c846b697b921e261f950f1848871ee17
SHA512

fd7194bdd1f2b2be75cab4221a7044fb59ffa40cb0a95807f5596e7ac80a8da45eab7b1bf32c7aae7e33919519029c7da86ba74c4d3e8c3b58c360a870a65869
SSDEEP

24576:4XB1URWBZeB1KRABqB1DRAB1DRAB1DR7B1DR7B1DRDRURNDR/B1DRHeNRHe3:4XPvHePnQPuPuPNPNP1ANPNePe3

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
NEAS.f77b8f6147c45f33000a3d56ef395360.exe
unpack001/out.upx

Files

NEAS.f77b8f6147c45f33000a3d56ef395360.exe
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 108KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 42KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 124KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ