NEAS[.]b099f7534d28498abbc917771f1826d0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.b099f7534d28498abbc917771f1826d0.exe
Size

329KB
MD5

b099f7534d28498abbc917771f1826d0
SHA1

e3ea68f2f8afc63a05d368c6f7e166a6fd97c68b
SHA256

30da434733adc6ec31b9e4e6fbb50b6b08948f3ec76df247e3a6713ae6bb8064
SHA512

bb2ee3e15d7ce6fc47afa1e606fddf2eb20ec394e52e8c2f64d36b79047ecec6ca224fa6eaa0de2190c7a38cb33bffb8ae60131b263401b957a59804cfc4cd35
SSDEEP

6144:AkGk7QmS+m2ZlNQsY3ODcBkGyfC6//fQvojS/kEOomspHRdL+XOirfuHDY9j:47PyWF3FY7/YvcE5sXOcMu

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.b099f7534d28498abbc917771f1826d0.exe

Files

NEAS.b099f7534d28498abbc917771f1826d0.exe
.exe windows:4 windows x86

c75e66c26439aff885388fba3b369a70

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

LoadLibraryA
ExitProcess
GetProcAddress
VirtualProtect

ntoskrnl.exe

IoSetTopLevelIrp

user32

DdeQueryStringA

msvcr100

_strnicmp

Sections

UPX0
Size: - Virtual size: 96KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.orpc
Size: 326KB - Virtual size: 328KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE