NEAS[.]715690aa0bd3ba9c8a7be96f51da3f50_JC[.]exe | Triage

Sharing

General

Target

NEAS.715690aa0bd3ba9c8a7be96f51da3f50_JC.exe
Size

612KB
MD5

715690aa0bd3ba9c8a7be96f51da3f50
SHA1

67d52fff47e7f099d573c922ae2fdc5c034f542d
SHA256

421ebc019625411b7cd3e2c65bb8866e8f18603165ab00d64204dbac2b2ada02
SHA512

8c9178e49ac789bcba3b009ef9b2848755fa5f41037aba8d7e86b396641d950c2d7a7b4150c29be5d78b83eea79b41afdd84e802478449ee514577fa4de8f58d
SSDEEP

12288:TLySlYJZK6WrxD7Q++C7dCKo6+P77pZXSm7f5W:T+SlOa1/Qfhj7pZV7f5W

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
NEAS.715690aa0bd3ba9c8a7be96f51da3f50_JC.exe
unpack001/out.upx

Files

NEAS.715690aa0bd3ba9c8a7be96f51da3f50_JC.exe
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 168KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.bss
Size: - Virtual size: 145KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE