NEAS[.]194a536a873c47388aa7e3a8867c3ac0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.194a536a873c47388aa7e3a8867c3ac0.exe
Size

582KB
MD5

194a536a873c47388aa7e3a8867c3ac0
SHA1

d09819c3477f0cdf58565ee6b7bb18aa4ec08874
SHA256

5fd352b6431b19a5efa7efb7921c69c1635147736735fc64a1364c8089aff813
SHA512

c460a1f6373216ed864a64fd37ebb3c87a558d4dd3cae149012c86d29080e17aab3c35f4aa6b99ccf3c6e67f110684721abfa31399a8d66d94dd814c34dc696e
SSDEEP

12288:zBAsu/1OsCzbT7YebtN2rMFpouF0/DD0:cMzEgNPFpoz/0

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.194a536a873c47388aa7e3a8867c3ac0.exe

Files

NEAS.194a536a873c47388aa7e3a8867c3ac0.exe
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Exports

Exports

?EngineProc@@YGJHIJ@Z
?pro_cess1@@YAHHHHPAD@Z
?pro_cess2@@YAHXZ
?pro_cess3@@YAHH@Z
?pro_cess5@@YAHH@Z

Sections

UPX0
Size: 372KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 156KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.imports
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE