NEAS[.]361925ea99f39717af6e4f4b109f74b0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.361925ea99f39717af6e4f4b109f74b0.exe
Size

248KB
MD5

361925ea99f39717af6e4f4b109f74b0
SHA1

167711ea995f46eac7b4e74f5de9ef23e05f799a
SHA256

d2d4363784c58ba9f1ea18276618baa81fa7516a581668f78d8654f430fa57be
SHA512

efddc404c4ab6efc9b3fc060489736346be2f1f147dd4456829874bf9d000805e04f5eb6561603757e39cb727d8eb59aa9bc7fad7c588c1ae7cf82c3adafe82a
SSDEEP

3072:mTivW+hQKR6tl/PY4ayzpuXV/xirdqYDpjH2y:mu+Q5UlXIgA/8T

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.361925ea99f39717af6e4f4b109f74b0.exe

Files

NEAS.361925ea99f39717af6e4f4b109f74b0.exe
.exe windows:1 windows x86

120c163627f56634f6f1cf5ddfc80997

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
GetModuleHandleA
GetProcAddress
CloseHandle
RtlUnwind
SetLastError
GetModuleHandleW
lstrcpyW
lstrcmpW
lstrcatW

crtdll

__GetMainArgs
exit
raise
signal

framedyn

?Compare@CHString@@QBEHPBG@Z

iphlpapi

GetAdaptersInfo

user32

GetCursorInfo

Sections

UPX0
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE