NEAS[.]105c5bbc5e3171a2dbeb6d613cb24550_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.105c5bbc5e3171a2dbeb6d613cb24550_JC.exe
Size

244KB
MD5

105c5bbc5e3171a2dbeb6d613cb24550
SHA1

890b1cfe01e050276e3eddc2df03de2a9ed96174
SHA256

28222c516b379cff26631e15592ecc052086e7053aedb2d853f65ce942e45157
SHA512

c8c2a2cdcefc91fd5be4133741fb6124906b931485a50bcbfb3fc37e273bd8a06461ed05fbd34c89a3a4b026b8b9fd838956c6c86ee58203ab021e6a5a01498e
SSDEEP

3072:rCrGJNOu3ap01kqMTue7gNbVB/rB78TFTHugCoReiVWeJfefVUx6v:rCyKp+kqKt7gZ3qTFbIyVWeU2x6v

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.105c5bbc5e3171a2dbeb6d613cb24550_JC.exe

Files

NEAS.105c5bbc5e3171a2dbeb6d613cb24550_JC.exe
.exe windows:1 windows x86

2c2dc9c295ee59c142dfd7ce22651b9e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetProcAddress
CloseHandle
RtlUnwind

advapi32

RegOpenKeyExA
RegQueryValueExA

crtdll

__GetMainArgs
exit
raise
signal

iphlpapi

GetAdaptersInfo

ntdll

RtlInitUnicodeString
RtlFreeHeap

ulib

?Usage@PROGRAM@@UBEXXZ

user32

GetCursorInfo

Sections

UPX0
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE