NEAS[.]5809d3c96db85798b7d3d5024b2758e1[.]exe | Triage

Sharing

General

Target

NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
Size

766KB
MD5

5809d3c96db85798b7d3d5024b2758e1
SHA1

0ed5cbbfef3c3d2510c4b3fbaa37e14a678ca721
SHA256

5c0b043ba5d2a716910669d8afd3aa16ae28769ffb8f80025c3274f51473f644
SHA512

5c84e6b1964b9d7a7fda41034772c48557340a880b37402492330ace7d9fcebdb8e9c50d11bb1c11c53603c7c172f2fa459f31e1c4e807bd1420292bc2ddf7d3
SSDEEP

12288:YEQoSpqh17Lqd0Hnzw9egihrFggt57GWtkncfbk3A4wioOgS6G13nIoUHOsExOjg:YilK2n89/8rFggt8Wacg3NvoC4oUN0HJ

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.5809d3c96db85798b7d3d5024b2758e1.exe

Files

NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
.exe windows:4 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 68KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ktlju
Size: 512B - Virtual size: 4KB

.wu
Size: 512B - Virtual size: 4KB

.shik
Size: 512B - Virtual size: 4KB

.nbd
Size: 512B - Virtual size: 4KB