NEAS[.]1b15491dafca58db24a9e5b27312b6c0_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.1b15491dafca58db24a9e5b27312b6c0_JC.exe
Size

332KB
MD5

1b15491dafca58db24a9e5b27312b6c0
SHA1

4f2e55a7b90278b266d6c8570302b78b2f1a8f68
SHA256

9e4e1fb33b0be471256ae79932000b6b1b7ff2dd72eab7d131d68dfcc1d13b75
SHA512

51b27d7185cf8d0010f310818a9c781887443695004620ea891c8b6c228860790a721386a6830f7f1146118465fcba548dd3daab40fcd3dee230f740159c16c5
SSDEEP

6144:SjluQoSKIo5RXrNv/7BxQ0oPAdV6GFUAT654PEPm36icmT3CVoOjbjLkeugXicS4:SEQoSenNvDvQLs6q64cPmqirbCVJn/pd

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.1b15491dafca58db24a9e5b27312b6c0_JC.exe

Files

NEAS.1b15491dafca58db24a9e5b27312b6c0_JC.exe
.exe windows:4 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.jxmnr
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.lpkez
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.g
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.i
Size: 512B - Virtual size: 4KB