NEAS[.]4cf354f1a4f39c642c59ac1c8dd3d3e0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.4cf354f1a4f39c642c59ac1c8dd3d3e0.exe
Size

101KB
MD5

4cf354f1a4f39c642c59ac1c8dd3d3e0
SHA1

d89ca75b2760f9f9e538b1f7cea791ffc6cd770e
SHA256

6bace217c17e8333e8abad2945518b8f25844a2a1e207fd499fdf740c2fc9e30
SHA512

3d13b60d2cbbf328b9c57f961fd210e8d2913a63c5cab7a8b698fe1c51be38d0badf85e69b023a5191ebc7f425327db5b60e3fe4de6577506defe91b3f70d3e5
SSDEEP

3072:Gogh4vaodYq/bDAtsT6VxLDGnfDOgkI8y:RghgL1DAeOLDQdkI8

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.4cf354f1a4f39c642c59ac1c8dd3d3e0.exe

Files

NEAS.4cf354f1a4f39c642c59ac1c8dd3d3e0.exe
.exe windows:5 windows x86

65919489510ee6100bf60e5915aa6a8c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
ExitProcess
GetProcAddress
VirtualProtect

ole32

CoUninitialize

oleaut32

VariantClear

user32

GetCursorPos

ws2_32

WSAGetLastError

advapi32

CredIsProtectedW

msvcr120

__uncaught_exception

Sections

.vmp1
Size: - Virtual size: 152KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 97KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE