NEAS[.]5d96fa41415b7498653e6000d6c56540[.]exe | Triage

Sharing

General

Target

NEAS.5d96fa41415b7498653e6000d6c56540.exe
Size

248KB
MD5

5d96fa41415b7498653e6000d6c56540
SHA1

3315eb92bd89e13e7a3422f2c9b0f57dc8ec1f81
SHA256

95734e42bd943e6233de21f3a72dea54cb036aacf8d3b92cee3ae50453a11853
SHA512

abe57b5783c455da80bc543d3fbd222d80769185c81110a6f052e8ce85f0d901857125e3695c58f64fa89356cf9a9ce1bc411ef47680739024a46b34b29d0b85
SSDEEP

3072:fwUtuJp5sgLMnwEK/wZX+xNIidFh8VaSM3eF4MitAdJ3+pJMr+V:fwUtuD5FYnwEftCNIidr+k3qquJSGm

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.5d96fa41415b7498653e6000d6c56540.exe

Files

NEAS.5d96fa41415b7498653e6000d6c56540.exe
.exe windows:1 windows x86

6cf6b7ca087d841c9daab77af713fe37

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
GetModuleHandleA
GetProcAddress
CloseHandle
RtlUnwind
GetModuleHandleW

crtdll

__GetMainArgs
exit
raise
signal

iphlpapi

GetAdaptersInfo

ntdll

RtlFreeHeap

ulib

??0PATH@@QAE@XZ
??0DSTRING@@QAE@XZ
??0STRING_ARGUMENT@@QAE@XZ

user32

GetCursorInfo

Sections

UPX0
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE