NEAS[.]27f9606e219abe5ccb72c8d7f3341fa0[.]exe | Triage

Sharing

General

Target

NEAS.27f9606e219abe5ccb72c8d7f3341fa0.exe
Size

32KB
MD5

27f9606e219abe5ccb72c8d7f3341fa0
SHA1

1a6d49eac43b9bc0a19068e38257503f8a8e1da9
SHA256

caaedba9eee05c3be7e77b8231481213e799e59ac02426793207328bf99ca27c
SHA512

71c83bef0a0c2c940d7185070288215954b2fd3459b401a9e1adfaecc39b03b8cdeba59b74f8c47329464e938a660c00707529d29a31f282a35b3e6957d3a6b4
SSDEEP

768:p5FvtTyWYTJcDG4bXDKq8cX3pjTc7DCDKNbxl:z3yWY1DtAJjInAKh

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.27f9606e219abe5ccb72c8d7f3341fa0.exe

Files

NEAS.27f9606e219abe5ccb72c8d7f3341fa0.exe
.exe windows:1 windows x86

36375558c487f2de3979b2e074a572cc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey

crtdll

atoi

gdi32

SetBkColor

kernel32

LoadLibraryA
ExitProcess
GetProcAddress
VirtualProtect
GlobalFree

msvcr100

strcat

msvcrt

memchr

ole32

CoInitialize

oleaut32

SysAllocString

user32

SetFocus

wininet

DeleteUrlCacheEntry

Sections

UPX0
Size: - Virtual size: 180KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 29KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1SBE
Size: 512B - Virtual size: 6B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.l1
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE