NEAS[.]7166e576f4587e10b6ce5380e9809d70[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.7166e576f4587e10b6ce5380e9809d70.exe
Size

46KB
MD5

7166e576f4587e10b6ce5380e9809d70
SHA1

b1151f63254094acd1bf36ba7d6521cf8d836b3b
SHA256

873d2021adef22c722651892d36ff57a3e0c5c27ed293dc3e9435b4de87f2d1d
SHA512

d1d120182e9d6e2b6e44fd1d464fb4d0c692448041db0753d33d93262c19bb966cf21f6024d02edd932953a7b1e289a7196f6cc24e6c5c8e5c23cd0dff889b1f
SSDEEP

768:U963CDxwZwOmso3OQ9fkeVMZjuNz1ZnTgmUQ4ajWsIZPT29pSpFA74/C9:U9CCDCZwORZpduTZvWsIZb29p4GU/C9

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
NEAS.7166e576f4587e10b6ce5380e9809d70.exe
unpack001/out.upx

Files

NEAS.7166e576f4587e10b6ce5380e9809d70.exe
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 28KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ