NEAS[.]5ab8033a8eb187a37ab43d3d915b5e20[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.5ab8033a8eb187a37ab43d3d915b5e20.exe
Size

248KB
MD5

5ab8033a8eb187a37ab43d3d915b5e20
SHA1

3d30686d3901e8c98409aff03d8ededc03ee04db
SHA256

fcc55f2033f9c6eb1a78ba2163d30559c8c0a1bb4d7b6d750a647878570604a2
SHA512

256091aa9533f2b8561edfe9c05f4ef7691f113a7810034c58f1ae1616e28551cdda6fe6e291230840d5a8411e0b43e21f84646d39b3e446bfb1c625de9703dd
SSDEEP

3072:mzVMfMIbIaw3J9MQ9lB+BC3K5eqU+BC3K5eqYroGAyfYpTqz:mefMmM2yK70K7Ol

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.5ab8033a8eb187a37ab43d3d915b5e20.exe

Files

NEAS.5ab8033a8eb187a37ab43d3d915b5e20.exe
.exe windows:1 windows x86

120c163627f56634f6f1cf5ddfc80997

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
GetModuleHandleA
GetProcAddress
CloseHandle
RtlUnwind
SetLastError
GetModuleHandleW
lstrcpyW
lstrcmpW
lstrcatW

crtdll

__GetMainArgs
exit
raise
signal

framedyn

?Compare@CHString@@QBEHPBG@Z

iphlpapi

GetAdaptersInfo

user32

GetCursorInfo

Sections

UPX0
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE