NEAS[.]ed9ab8a6cad4c66c6a8b82b21032bb42[.]exe | Triage

Sharing

General

Target

NEAS.ed9ab8a6cad4c66c6a8b82b21032bb42.exe
Size

684KB
MD5

ed9ab8a6cad4c66c6a8b82b21032bb42
SHA1

1f38247f74b6911e591b206b583e38174324d656
SHA256

ea0675e2c5a28b477d8b3057d32525d378a0fc98c91612e39c4bb9e0b960a7f1
SHA512

1344db0fa49c727ba010b4945a84c731564ba33d2af6d3acd18cf283d74930f591e5c54815be3991a0a2fe7167b6ffa4b2952e830d96feeb28f33ca08d1e3379
SSDEEP

12288:SEQoSz2jhQQy/MHns0CdxhjbM+u62cFD0kuLI5z48i2bd6ZV2clLH/G6yM8:SR2jO1QnrCdxhXM+uekmb4V2gLfG6yM8

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.ed9ab8a6cad4c66c6a8b82b21032bb42.exe

Files

NEAS.ed9ab8a6cad4c66c6a8b82b21032bb42.exe
.exe windows:4 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.jxmnr
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.lpkez
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.g
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.i
Size: 512B - Virtual size: 4KB