NEAS[.]fe4e11ad6852046b92e34855a1814130[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.fe4e11ad6852046b92e34855a1814130.exe
Size

244KB
MD5

fe4e11ad6852046b92e34855a1814130
SHA1

27b2cf41ddfb565afd7954f11a67cc3c29995ab3
SHA256

c03f21961cc8fe77640338ead056aeffaf927c0284e0f0b9a1ae0c6ce93db52a
SHA512

05fce95a4642841aa470ef6347b2740bd11488b77e96ea22613003902f09c105a30ea6e17d9db10b3485962fbf95804f4ae772155b1d57772029c09f973a5302
SSDEEP

3072:rCrGJNOu3ap01kqMTue7gNbVB/rB78TFTHugCoReiVWeJfefVUx6d:rCyKp+kqKt7gZ3qTFbIyVWeU2x6d

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.fe4e11ad6852046b92e34855a1814130.exe

Files

NEAS.fe4e11ad6852046b92e34855a1814130.exe
.exe windows:1 windows x86

2c2dc9c295ee59c142dfd7ce22651b9e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetProcAddress
CloseHandle
RtlUnwind

advapi32

RegOpenKeyExA
RegQueryValueExA

crtdll

__GetMainArgs
exit
raise
signal

iphlpapi

GetAdaptersInfo

ntdll

RtlInitUnicodeString
RtlFreeHeap

ulib

?Usage@PROGRAM@@UBEXXZ

user32

GetCursorInfo

Sections

UPX0
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE