NEAS[.]bd8fec9378dfc939288346680b6e8290_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.bd8fec9378dfc939288346680b6e8290_JC.exe
Size

94KB
MD5

bd8fec9378dfc939288346680b6e8290
SHA1

93f10393e51122924d9303be5841b029da9cd3c3
SHA256

2c18c519454c1d5d56b8cbcdd1a79df6ea44039b8ac5eac1b4f3250faac2f2f2
SHA512

9c963c6339fb8e08712588391c650c5c2820c9c6e4a68e1935ed61f0376537409b1dc3553933a2f7da09c68011d3931c5292ac2092c91b0a1acc02b7a38b1a41
SSDEEP

1536:yDRVCaKgzbLc54hukfgvYnouy8wV1Ayj4m/QWR/Rd+/yLPcTG:y9jbLl/gvQoutE1Tj4mYWR/RMicy

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.bd8fec9378dfc939288346680b6e8290_JC.exe

Files

NEAS.bd8fec9378dfc939288346680b6e8290_JC.exe
.exe windows:4 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.jxmnr
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.lpkez
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.g
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ