Behavioral task
behavioral1
Sample
NEAS.5b3c4cbe71177a323143587b40a08c20.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.5b3c4cbe71177a323143587b40a08c20.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.5b3c4cbe71177a323143587b40a08c20.exe
-
Size
82KB
-
MD5
5b3c4cbe71177a323143587b40a08c20
-
SHA1
672c3e726cef51ef057426cedc647fd7416af4bc
-
SHA256
beff65f72bc21db4098e5e972c664846d79969af3eb45f18f1c764185998f6af
-
SHA512
9dc3030b778eaf47bf5d00f2a962a6b8b51d93ae5915acef599679edf704510460e01b539eb93b803040db9b9558664c84d1ac00c848d73ffa34f30dd35e0feb
-
SSDEEP
1536:4LKCxc6ythktVsC9bMn7PoC3txg89FpMhQu9dG0z3DURkFmiLCFiT:ily6aqOn7ACE89zMfo0z3YRmmG82
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.5b3c4cbe71177a323143587b40a08c20.exe
Files
-
NEAS.5b3c4cbe71177a323143587b40a08c20.exe.exe windows:4 windows x86
ef8ac61f0a72dfe2a00756a6b4e83db4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
atl
ord42
gdi32
BitBlt
gdiplus
GdiplusStartup
msimg32
AlphaBlend
msvcrt
atoi
ole32
CoInitialize
oleaut32
VariantClear
shell32
DragFinish
shlwapi
StrToIntExA
user32
GetDC
wininet
InternetOpenA
Sections
UPX0 Size: - Virtual size: 496KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 74KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE