NEAS[.]4d751d4d505c533a70153d23f1f41d20[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.4d751d4d505c533a70153d23f1f41d20.exe
Size

336KB
MD5

4d751d4d505c533a70153d23f1f41d20
SHA1

eb38c95ebb346c3eb2ce709a3e194510db3ab9d7
SHA256

e868b70664f0011128d9b360ecc99be1d10208e1c2f9b2928da55965ea9b8bab
SHA512

0488b789eeb1380f856b31e82a7a9b8512b3b34a26199647025bf300b45df8a9630692b5aafeea2a565a5a484be5869bf9d742688746047e3a36d60bca2ad41e
SSDEEP

1536:Lotri2fpbspOhotri2RpbspOhotri2upbspO:LWrfpg2WrRpg2Wrupg

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.4d751d4d505c533a70153d23f1f41d20.exe

Files

NEAS.4d751d4d505c533a70153d23f1f41d20.exe
.exe windows:4 windows x86

d028ed91d908ca3f4bdbbbb8a346d246

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
HeapCreate
HeapDestroy
ExitProcess
CloseHandle
InitializeCriticalSection
GetModuleFileNameA
HeapAlloc
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetTickCount
TlsGetValue
CopyFileA
WriteFile
HeapFree
CreateFileA
SetFilePointer
GetFileSize
ReadFile
EnterCriticalSection
HeapReAlloc
LeaveCriticalSection
TlsFree
GetLastError
SetLastError
WaitForMultipleObjects
GetCurrentProcess
GetCurrentThread
DuplicateHandle
CreateSemaphoreA
CreateThread
ReleaseSemaphore

msvcrt

memset
strcmp
memmove
memcpy
strncpy
strlen

Sections

UPX0
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE