Behavioral task
behavioral1
Sample
NEAS.c249a761a491ef9697d03f0274eb4070.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.c249a761a491ef9697d03f0274eb4070.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.c249a761a491ef9697d03f0274eb4070.exe
-
Size
1.7MB
-
MD5
c249a761a491ef9697d03f0274eb4070
-
SHA1
4533dbc16089e97504510cd17e14acf02f912eb7
-
SHA256
1199461c03fd8561888ff5ebefe668bbd60c95f230742250c27c67f0a17cc68e
-
SHA512
2941fd9432786e174e50396d27879117fc1a61b0e3eb4828575ec8b526a712cb637a5ca8540fbbfccdb7252ae0d0e1bc4e1e2bdf97abe84770486f67c90af89d
-
SSDEEP
24576:YoBs/pYvG56XxNMSyzdbqcyT4KxIMPBmeLX6uDiV1dtTxuBobRfKhIscmCwwDMU/:XBcp5oQEdT4KxJpRU11uilKBCj4UeUdj
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.c249a761a491ef9697d03f0274eb4070.exe
Files
-
NEAS.c249a761a491ef9697d03f0274eb4070.exe.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 68KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ktlju Size: 4KB - Virtual size: 4KB
.wu Size: 512B - Virtual size: 4KB