Behavioral task
behavioral1
Sample
NEAS.90765a8b5721e294b2f9b14e46fe8190_JC.exe
Resource
win7-20231023-en
General
-
Target
NEAS.90765a8b5721e294b2f9b14e46fe8190_JC.exe
-
Size
203KB
-
MD5
90765a8b5721e294b2f9b14e46fe8190
-
SHA1
a3ed4769c845a7d474711a5706211228098cd73c
-
SHA256
edac9604178f88a87d50f309014747a484b5d86f59a7af339851c3bdd0b6b06e
-
SHA512
e9d75e84d772c8cafc5835d6a91b7aa9ee3c9050cfa5382db6d613e61709a979f998da2924b498e30fa8a13035ac0f2eaa16044f9ad893b87415853cf83f009d
-
SSDEEP
3072:DPijU4kcITkEnbBvByrEVoULptsdXfBo/DBJBGzkP9gx:LijBkcITtnbBvnjLpSa/2x
Malware Config
Signatures
-
Urelas family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.90765a8b5721e294b2f9b14e46fe8190_JC.exe
Files
-
NEAS.90765a8b5721e294b2f9b14e46fe8190_JC.exe.exe windows:5 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
KASANOVA Size: 148KB - Virtual size: 156KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
KASANOVA Size: 49KB - Virtual size: 52KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ