NEAS[.]db2a8ff104490e93ab022cb9f7f6e250[.]exe | Triage

Sharing

General

Target

NEAS.db2a8ff104490e93ab022cb9f7f6e250.exe
Size

30KB
MD5

db2a8ff104490e93ab022cb9f7f6e250
SHA1

942beec24a6d8db002faedf4fabdcd3984418ba8
SHA256

69bc7b4592173cdeeae195f4fc673ac76d611e5e85e958c26e9b7a3ab3ca5839
SHA512

d81ec5c5892bf532e0bc925e302f16e9e3195236f7f186e820fb20824486be4101f8179510395afbfdae950d4f84dfe8195c67f4d06d5b9fb5eb63dd00aa34b5
SSDEEP

768:GX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIoS:0KcR4mjD9r821

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.db2a8ff104490e93ab022cb9f7f6e250.exe

Files

NEAS.db2a8ff104490e93ab022cb9f7f6e250.exe
.exe windows:5 windows x86

188c439a05c8b787188ac435254d4738

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey

kernel32

LoadLibraryA
ExitProcess
GetProcAddress
VirtualProtect

ntdll

NtClose

user32

wsprintfW

msvcrt

sqrtf

Sections

UPX0
Size: - Virtual size: 56KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 24KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE