NEAS[.]51a62ece986cf952ef32405c8bbd5380[.]exe | Triage

Sharing

General

Target

NEAS.51a62ece986cf952ef32405c8bbd5380.exe
Size

341KB
MD5

51a62ece986cf952ef32405c8bbd5380
SHA1

8942b5d9d3bd26a0c958034d943a8cf47ca8ec78
SHA256

7dbeb60e775e0b02e6f1333d1cd4dcd86813b2e2533128942b10d1a5862152d1
SHA512

056ec17dbacb9c075df2f1b72f969d085313a7a37cd92053246fca3c2936cb735af40d31f99d72621e5fb201aeea866b114b1946ea55ba0aa55a18dd2bb013cc
SSDEEP

6144:YKijkqa0S4WhxkTuWpovm53ij/gzCp4sJss4x8laE1qdrlRoov6VmSJ:YPYdth+poo3i/xJsRxV9nRRAm

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
NEAS.51a62ece986cf952ef32405c8bbd5380.exe
unpack001/out.upx

Files

NEAS.51a62ece986cf952ef32405c8bbd5380.exe
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 368KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 309KB - Virtual size: 312KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 31KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 452KB - Virtual size: 451KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 180KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE