NEAS[.]ab7540cb3b8bbfe01b8f2d3a259fae40[.]exe | Triage

Sharing

General

Target

NEAS.ab7540cb3b8bbfe01b8f2d3a259fae40.exe
Size

248KB
MD5

ab7540cb3b8bbfe01b8f2d3a259fae40
SHA1

f6d74fb95ca4613379298c5594d0cc03e823edc4
SHA256

5a9c92386a16020e6b1503d1b0288ad3699e5a3101ec22b44fbf45a418d2eaa9
SHA512

a7e978aacae8e3d925f8ab40b81011c1cdcee10d235f4137f19b53deb7e8d5e662564132c5b43e05e68de3d20c712a6fc7e9ff7c66b0a6c4c8b61eb4123093e6
SSDEEP

3072:fwUtuJp5sgLMnwEK/wZX+xNIidFh8VaSM3eF4MitAdJ3+pJMr+C:fwUtuD5FYnwEftCNIidr+k3qquJSGN

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.ab7540cb3b8bbfe01b8f2d3a259fae40.exe

Files

NEAS.ab7540cb3b8bbfe01b8f2d3a259fae40.exe
.exe windows:1 windows x86

6cf6b7ca087d841c9daab77af713fe37

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
GetModuleHandleA
GetProcAddress
CloseHandle
RtlUnwind
GetModuleHandleW

crtdll

__GetMainArgs
exit
raise
signal

iphlpapi

GetAdaptersInfo

ntdll

RtlFreeHeap

ulib

??0PATH@@QAE@XZ
??0DSTRING@@QAE@XZ
??0STRING_ARGUMENT@@QAE@XZ

user32

GetCursorInfo

Sections

UPX0
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE