Behavioral task
behavioral1
Sample
NEAS.e4d78154cec055dc4af59893a7280730.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.e4d78154cec055dc4af59893a7280730.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.e4d78154cec055dc4af59893a7280730.exe
-
Size
1.6MB
-
MD5
e4d78154cec055dc4af59893a7280730
-
SHA1
1263ab427e8115a39930f28915c88eb7a030d221
-
SHA256
b647866e3b3e56f222c37b85d9dceda3f5747ba8cf34da21bf268f931ad5fc90
-
SHA512
0b98d7960da9c0aa8262fde3b88c346204cbd4e598dac837924a87031f31a14b3472778cb3d0b8f624a4a4393bbb41b3845a1f05d5a73b61e8f54ac64816f9e9
-
SSDEEP
24576:FdpbL9djdAL6OmcnaC30xSVZssnGWWMxTwl1:F7bL9hdAL6Baa7S8iWw
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource NEAS.e4d78154cec055dc4af59893a7280730.exe unpack001/out.upx
Files
-
NEAS.e4d78154cec055dc4af59893a7280730.exe.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 92KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 58KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 99KB - Virtual size: 99KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ