NEAS[.]a7b5bf4b4557e6c904267d456d9e9b00[.]exe | Triage

Sharing

General

Target

NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe
Size

176KB
MD5

a7b5bf4b4557e6c904267d456d9e9b00
SHA1

31b0dd3e8874a87c2f2c9094310682310f8a5164
SHA256

1e4c0f81bafca73880fa3d54bd8517e8378bc8b7fe5f42f32446b2bbd744aef9
SHA512

3a6add4516795faeb682c455617a1ab9b676dc34f5482461ee9e8bc191a8ce2fe462ce3d9096d3ad208e475b526a2d33fc30b74ec30bacc9cf58858b74525cc2
SSDEEP

768:Ac/TbblFpQNwC3BEc4QEfu0Ei8XxNDI/vFaaz6JZ1Ssw63BEfU:x7bbl/eThavEjDUvFaaAXZL0U

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe

Files

NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe
.exe windows:4 windows x86

1639b1e17656fed4f63bac94cbb79cec

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

MethCallEngine
ord593
ord594
ord595
ord598
ord525
ord526
EVENT_SINK_AddRef
ord529
DllFunctionCall
ord670
EVENT_SINK_Release
ord600
ord601
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord607
ord608
ord530
ord716
ProcCallEngine
ord537
ord645
ord570
ord685
ord100
ord616
ord546
ord547
ord580

Sections

UPX0
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE