NEAS[.]e423f57009776ac00c555735b3bf59b0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.e423f57009776ac00c555735b3bf59b0.exe
Size

244KB
MD5

e423f57009776ac00c555735b3bf59b0
SHA1

1a9ecbd91beabede4e80ac0579e3de74fdeaffbc
SHA256

8d9ee2e52d75372ccc032eca1f07166465c3cfa880be3a5106cf074b719081cc
SHA512

a1080438e7904d3f73a1b0796672392aef7c5e42ed01153afc03109bc6d9477a16cf7f4c8834cb24cb30323f7ff8b339efabd360e5d6c2f57921e6781a3d2173
SSDEEP

3072:rCrGJNOu3ap01kqMTue7gNbVB/rB78TFTHugCoReiVWeJfefVUx6R:rCyKp+kqKt7gZ3qTFbIyVWeU2x6R

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.e423f57009776ac00c555735b3bf59b0.exe

Files

NEAS.e423f57009776ac00c555735b3bf59b0.exe
.exe windows:1 windows x86

2c2dc9c295ee59c142dfd7ce22651b9e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetProcAddress
CloseHandle
RtlUnwind

advapi32

RegOpenKeyExA
RegQueryValueExA

crtdll

__GetMainArgs
exit
raise
signal

iphlpapi

GetAdaptersInfo

ntdll

RtlInitUnicodeString
RtlFreeHeap

ulib

?Usage@PROGRAM@@UBEXXZ

user32

GetCursorInfo

Sections

UPX0
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE