neshta | NEAS[.]a9f28da4d55080e23c0a32a15831b440[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.a9f28da4d55080e23c0a32a15831b440.exe
Size

153KB
MD5

a9f28da4d55080e23c0a32a15831b440
SHA1

a15ebab195a6472e3452bd9584348f6540332088
SHA256

f01b5d6a25b9f9a6b3f0b3fa47f75a65ca7815fea20695a6e2d6f4e0bfbb6cb8
SHA512

30d4b05b423e918f69d2625cca948d2f3b6094af21f981fe4e30446fddafb57a354dd663be0f12179a8af59574b04bfda6a8d61c1d813f5630287731fd3c4697
SSDEEP

1536:JxqjQ+P04wsmJCF7Z/lQ9GzyajY/0wT3nFyajY/0wT3n:sr85CNLQ9GeajY/yajY/

Score

10^/10

neshta

Malware Config

Signatures

Detect Neshta payload 1 IoCs

resource	yara_rule
sample	family_neshta

Neshta family
neshta

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.a9f28da4d55080e23c0a32a15831b440.exe

Files

NEAS.a9f28da4d55080e23c0a32a15831b440.exe
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 42KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ