NEAS[.]9f28a38b230db69c2fbaa457b5129b20_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.9f28a38b230db69c2fbaa457b5129b20_JC.exe
Size

45KB
MD5

9f28a38b230db69c2fbaa457b5129b20
SHA1

689fc1d973bbbfbad3c6e0b96a4709bb2a67281e
SHA256

4b9267de449d3306ef3f9951539dcd1cb2a140f8e14c7e407e9f7d2a55c157c1
SHA512

c5d0536b7a7bc7d8b043acfa22ebf6b21e4197321d2df8205957b6ffcb702908a7b493e8e036c51e1e430a571a212f14e533d3c268101463131fc52e46a1f11e
SSDEEP

768:U963CDxwZwOmso3OQ9fkeVMZjuNz1ZnTgmUQ4ajWsIZPT29pSpFA74/CO:U9CCDCZwORZpduTZvWsIZb29p4GU/CO

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
NEAS.9f28a38b230db69c2fbaa457b5129b20_JC.exe
unpack001/out.upx

Files

NEAS.9f28a38b230db69c2fbaa457b5129b20_JC.exe
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 28KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ